MediaWiki

User:Svemir Brkic/Releases

< User:Svemir Brkic

MediaWiki 1.35 edit

MediaWiki 1.35.14 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.13 edit

  • Localisation updates.
  • (T344912) mail: Encode period (ascii 46) if it appears in encoded email header.
  • (T347726, CVE-2023-PENDING) SECURITY: logging: Fix non-escaped messages used in rights log.

MediaWiki 1.35.13 edit

This is a maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.12 edit

  • Tarball release to fix backport issues with patch for task T341529.

MediaWiki 1.35.12 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.11 edit

  • Localisation updates.
  • (task T333050, CVE-2023-45363) SECURITY: Fix infinite loop for self-redirects with variants conversion.
  • (task T341434) WikiImporter: Improve error message output.
  • (task T341737) ApiBase: Cast $id to string in filterIDs.
  • (task T342632) ApiComparePages: Add help url.
  • (task T347227) ImportReporter: Make callback functions public.
  • doc: Improve description of type in extension.schema.v1.json.
  • (task T340221, CVE-2023-45360) SECURITY: XSS via 'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
  • (task T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression.
  • (task T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML file to Special:Upload (non-standard configuration).

MediaWiki 1.35.11 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.10 edit

MediaWiki 1.35.10 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.9 edit

  • Localisation updates.
  • (task T324895) MWCallbackStream: Add explicit $stream property.
  • Remove /images .htaccess rules that are no longer relevent.
  • Disable php in .htaccess of images directory as a hardening measure.
  • (task T322583) Include missing message parameter in message.
  • Fix phan error when Excimer is enabled.
  • (task T274966) tests: Make pass on php8.0.
  • (task T323373) Parser: Fix extractSections() behavior for PHP >= 8.0.
  • (task T326021) Add matrix: to $wgUrlProtocols.
  • api/en.json: api-help-datatype-expiry add missing 'may'.
  • (task T225218) Wait until the recent changes are updated.
  • (task T328222) Pass empty string to strlen() if schema is null for PostgresDatabase.
  • (task T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
  • (task T289926) SpecialRevisionDelete: Set default of for wpReason.
  • (task T155582, task T328503) Fix XML dumps for content types with non-string getNativeData().
  • (task T295958, task T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
  • (task T314099) revisiondelete: Replace dynamic property Status::$itemStatuses.
  • (task T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
  • (task T292348) WikiImporter: do not fail if upload entry in dump lacks 'text' tag.
  • (task T329484) API: Fix query+allimages user parameter description.
  • (task T330529) SpecialEditTags: Set default of for wpReason.
  • (task T330526) htmlform: Handle null from HTMLFormField::getDefault in multiselects.
  • (task T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted XFF headers.

MediaWiki 1.35.9 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.8 edit

MediaWiki 1.35.8 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.7 edit

  • Localisation updates.
  • (task T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
  • (task T311559) SpecialListFiles: user parameter isn't always present.
  • (task T311561) ImageListPager: Don't call htmlspecialchars() on null.
  • (task T311920) SpecialBlockList: Prevent passing null to trim().
  • (task T311921) SpecialUserrights: Don't pass null to str_replace.
  • (task T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize().
  • (task T311574, task T311576) SpecialLinkSearch: Don't pass null through to the parser.
  • (task T312519, task T312520) Parser::extensionSubstitution() Don't run substr() on null.
  • (task T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
  • (task T312302) SpecialRedirect: Don't pass null to explode.
  • RemoveInvalidEmails: Fix quoting for postgres.
  • (task T312678) import: UploadSourceAdapter::stream_read() don't pass null to strlen().
  • (task T312300) SpecialDiff: Don't pass null to explode().
  • (task T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
  • (task T289926) Handle null passed to wfShorthandToInteger() and Html::element().
  • (task T289926) Ensure that strlen() does not get passed a (valid) null.
  • (task T312301) SpecialDiff: Don't pass null to trim().
  • Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
  • (task T289926) Ensure we don't pass null to mb_strlen.
  • (task T312305, task T311572, task T311571, task T311578) HtmlForm: Null coalescence in trim() calls.
  • (task T289926) site: Consistently return null from Site::getDomain().
  • (task T307304, task T289879) filebackend,jobqueue: Add signature for FilterIterator::accept().
  • (task T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
  • Add application/vnd.ms-opentype to MIME list.
  • Allow composer/installers plugin in composer.json.
  • (task T313663) Make HandlerTestTrait compatible with php8.1.
  • (task T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
  • Change type hints for BatchRowIterator and NotRecursiveIterator for compatibility with PHP 8.1.
  • (task T313663) [php8] Don't use strlen on potentially null string.
  • (task T313663) [php8.1] Suppress test warning about providing null.
  • (task T313663) Parser will use current timestamp instead of null if passed a RevisionRecord that does not have a timestamp.
  • (task T313663) Add explicit null check for $sha in FileBackend [php8.1].
  • (task T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
  • (task T289879, task T289926) Get rid of warnings on PHP 8.1.
  • rdbms: fix some PHP 8 warnings in Database/LoadBalancer/LBFactory.
  • (task T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
  • Fix a couple deprecation warnings in the installer under PHP 8.1.
  • (task T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
  • (task T314096) Migrate use of ${var}-style string interpolation.
  • (task T313663, task T313662) Make default value for optional args 0 be not null.
  • (task T314225) SpecialCategories: Null coalescene $par.
  • (task T314099) User: Allow dynamic properties on PHP 8.2.
  • (task T314404) SpecialGoToInterwiki: Null coalescene $par.
  • (task T314397) SpecialBlock: Better handle null in getTargetUserTitle.
  • (task T314099) phpunit: Fix trivial dynamic property usages in tests.
  • (task T314405) UploadStash: Check if us_prop is set in the fileMetadata.
  • (task T314550) SpecialMergeHistory: Set timestamp to if no mergepoint.
  • (task T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
  • api: Add rel=nofollow to help examples.
  • (task T314824) tests: Update parser test after i18n change.
  • (task T263927) Add autocomplete HTML attribute to common auth form fields.
  • (task T307613) Validate length of user email on Special:ChangeEmail/Special:CreateAccount.
  • (task T314906, task T314907) SpecialBlock: Set defaults for wpPageRestrictions and wpNamespaceRestrictions.
  • (task T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
  • (task T315892) composer.json: Pin phpunit to 8.5.28.
  • (task T229092) MigrateActors.php: ignore duplicate creations of actors.
  • (task T313049) Bump wikimedia/parsoid to v0.12.3.
  • (task T317750) session: Fix broken SessionTest case due to PHPUnit dependency change.
  • (task T318460) SpecialChangeEmail: Set default for returntoquery.
  • (task T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results in an IP range check on Special:Contributions.
  • (task T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence of hidden users.

MediaWiki 1.35.7 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.6 edit

  • Localisation updates.
  • (task T289879) Type hints for ArrayAccess.
  • (task T304783) TemplateParser: avoid warnings when called by NoLocalSettings.
  • Rebuilt vendor with composer 2.3.3.
  • (task T289879) Address some deprecations for PHP 8.1.
  • Fix old_name in UserLogoutComplete hook.
  • (task T286260, task T307979) objectcache: normalize $exptime to a TTL in APCUBagOStuff/WinCacheBagOStuff.
  • MediaSearchWidget should declare an explicit dependency on mediawiki.user module.
  • (task T288423) WikiImporter: Replace deprecated WikiRevision::setText.
  • (task T309377, CVE-2022-29248, task T311384, CVE-2022-27776) Updating guzzlehttp/guzzle (6.5.5 => 6.5.8).
  • (task T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
  • (task T311272) Call parent constructor of AddSite maintenance script first.
  • MediaWiki: Don't eagerly initialize action name.
  • (task T289926) Avoid passing null to trim() in SkinTemplate.
  • (task T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
  • (task T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
  • (task T311569) FileBackend::isStoragePath() Handle being passed null.
  • (task T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
  • (task T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
  • (task T281741) ChangeTags: Fix adding CSS classes for hidden tags.
  • (task T296642) changetags: Fix management of a '0' tag.
  • (task T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
  • (task T303033) Handle null in ChangeTags::modifyDisplayQuery.

MediaWiki 1.35.6 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.5 edit

  • (task T298261) Fix support for Composer 2.2.
  • (task T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
  • Update doctrine/dbal (3.0.0 => 3.1.5).
  • (task T298564) MemcachedClient: Add support for IPv6.
  • (task T297543, CVE-2022-28202) SECURITY: properly escape output used within galleries and Special:RevisionDelete.
  • (task T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
  • (task T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
  • (task T274966) Upgrading wikimedia/html-formatter (1.0.2 => 2.0.1).
  • Fix the json schema and the extension processor for Parsoid extension modules.
  • (task T299696) update.php: Avoid passing null to substr.
  • In PHP 8.1 don't throw exceptions from mysqli.
  • (task T289926) SiteConfiguration: Don't pass null to str_replace().
  • (task T264735) Fix deprecation warning from CURLPIPE_HTTP1.
  • (task T260735) Stop using is_resource() where possible.
  • (task T289879) Apply ReturnTypeWillChange to various implementations of built in interfaces.
  • (task T299312) Implement __serialize/__unserialize for PHP 8.1 support.
  • ExtensionRegistry: Add process cache for lazy attributes.
  • (task T301041) ApiPageSet: Add "missing": true to missing revisions.
  • Allow ParsoidModules extension schema to register services.
  • (task T297708) Allow setting max execution time to several special pages.
  • Upgrading wikimedia/object-factory (v2.1.0 => v2.2.0).
  • (task T302540) composer.json: Add ext-calendar to require.
  • (task T302540) composer.json: Add ext-simplexml to require-dev.
  • (task T302540) composer.json: Add various PHP extensions to suggests.
  • Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
  • (task T303871) Add Title::getId() as an alias for ::getArticleId().
  • (task T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
  • (task T293576) listFiles: Display file name instead of version.
  • (task T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
  • wrapOldPasswords: add \n to two output calls.
  • (task T304993) Make editcontentmodel a part of editpage grant.
  • (task T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion loop if it points to a local interwiki.
  • (task T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file uploads with actor as a condition can result in a DoS.

MediaWiki 1.35.5 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.4 edit

  • (task T290697) Add symfony/polyfill-php80.
  • IcuCollation: Add some more icu to unicode version mappings.
  • ApiBase: Annotate deprecated constants individually.
  • PHPVersionCheck: Mark PHP 7.4.0 - 7.4.2 as buggy.
  • (task T293044) installer: Fix 5th param to sourceFile() in DatabaseUpdater.
  • (task T291127) Always encode spaces in cookie values as "%20".
  • Use LocalFile::getHookRunner instead of LocalFile::hookRunner.
  • HistoryBlobStub: add getLocation() to get $mOldId.
  • Fix checkStorage.php.
  • checkStorage: pass no parameters to WikiRevision::getContent().
  • (task T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion results.
  • (task T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
  • (task T250068) resources: Upgrade jQuery from 3.4.1 to 3.6.0.
  • (task T250068) resources: Upgrade jquery-migrate from 3.1.0 (patched) to 3.3.2 (patched).
  • (task T294796) JobQueueRedis: Replace deprecated zSize with zCard.
  • (task T212428, task T267468) Allow populateContentTables to continue when there are bad blobs.
  • (task T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is set.
  • Update pear/mail_mime to 1.10.11.
  • Update deprecated Guzzle Psr7 function calls.
  • Tweak error message for missing composer dependencies.
  • (task T296112) Allow inserting new sections named '0'.
  • nukeNS: don't run purgeRedundantText() after every change.
  • (task T225888) RollbackAction: fix missing pagetitle.
  • (task T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in undo actions.
  • (task T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
  • (task T34716, task T297416) SECURITY: Require 'read' right for most actions.
  • (task T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook when changing content model.

MediaWiki 1.35.4 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.3 edit

  • (task T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
  • (task T283273) Make postgres IRC channel point to libera.chat.
  • (task T289108) ExtensionProcessor: Remove loaderScripts from extension.json schemas.
  • (task T281549) Installer: Fix mediawiki-announce auto subscription code.
  • FormatJson: Optimize encode() for supported PHP versions.
  • (task T290398) renameRestrictions.php: Update protected_titles as well.
  • $wgMimeTypeBlacklist - This configuration array now prohibits the
Request for comment (RFC)
Releases
Component General
Creation date {{{created}}}
Author(s) {{{author}}}
Document status

form of JavaScript, 'application/javascript', as well as previous MIME types.

MediaWiki 1.35.3 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

Changes since MediaWiki 1.35.2 edit

  • (task T259685) SQLite compatibility with ZeroConf VisualEditor was fixed in 1.35.2.
  • (task T196906, task T242751) Fix the test MonologSpiTest::testDefaultChannel.
  • (task T279964) Parser: Trim trailing whitespace as the last step in pre-save transform.
  • (task T278026) rdbms: Add DB_PRIMARY to replace DB_MASTER.
  • (task T252853) Update updateSearchIndex.php to 2006+ standards.
  • (task T276945) Define a batch size in maintenance/manageJobs.php.
  • (task T276945) Implement JobQueueDB::getAllAbandonedJobs.
  • (task T269676) authevents: strval() variables passed to status when logging.
  • (task T280944) $wgIncludejQueryMigrate - This setting allows the jQuery Migrate plugin to be disabled. It has been enabled by default since MediaWiki 1.27.
  • (task T281584) apihelp-query+iwlinks-param-prop: s/interlanguage/interwiki/.
  • (task T281635) Delete maintenance/cleanupAncientTables.php.
  • (task T282133) RedisConnectionPool: Suppress phan issue.
  • (task T281549) WebInstaller: Don't show the announce-l subscribe checkbox temporarily.
  • (task T278266) Fix annoying E_NOTICE about undefined 'alt' index in Skin#makeFooterIcon.
  • (task T264214) UserRightsProxy::addGroup has to be allowed to update the old group as well, which is used for granting interwiki rights.
  • (task T269776, task T278266) getFooterIcons should not return empty arrays.
  • (task T274966) Skip AvroFormatterTest::testSchemaNotAvailable on PHP 8.0.
  • phpunit: fail on warnings.
  • (task T283247) Freenode -> Libera per wikimedia moving from freenode to libera.
  • (task T243124) Make phpunit:unit accept extension*.json to populate the classes.
  • (task T142663) Add extension.json merge strategy "provide_default".
  • (task T283540) HookContainer: Fix normalization of callback for static handler.
  • (task T283464) Fix array order for array_replace_recursive merge strategy.
  • (task T247223) Optimise MessageCache::isMainCacheable() for the single-message case.

MediaWiki 1.35.2 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

MediaWiki 1.35.2 supports Composer 2.0. It is recommended to make sure your libraries are up to date on Composer 1.x, before running Composer 2.x.

While normally running update.php isn't required for point releases, it is recommended to run it for 1.35.2 so that iwlinks.iwl_prefix is updated to take 32 characters.

Changes since MediaWiki 1.35.1 edit

  • (task T270450) The confusingly-named User->isLoggedIn() method has been deprecated in favour of the method it wraps, User->isRegistered().
  • Upgrade pimple/pimple from 3.3.0 to 3.3.1 for PHP 8.0 support.
  • Upgrade seld/jsonlint from 1.7.1 to 1.8.3 for PHP 8.0 support.
  • Upgrade doctrine/dbal from 2.10.4 to 3.0.0 for PHP 8.0 support.
  • (task T270734) Fix display of Special:Preferences URL in password reset email.
  • (task T252774, task T271441) resourceloader: Give SkinModule 'features' option an extensible default.
  • (task T271441) Unknown features shouldn't break style output.
  • (task T264986) Make use of CURLMOPT_MAX_HOST_CONNECTIONS conditional on having curl >= 7.30.0.
  • DefaultSettings.php: Update $wgPingback documentation.
  • Fix docs for LanguageConverter::translate.
  • (task T272250) Don't rely on implicit string->int cast in comparison.
  • (task T272327) Exif::isSlong: Cast input to float so PHP 8.0 abs() doesn't whine.
  • (task T272328) UploadBase: Don't call MimeAnalyzer if mTempPath is null.
  • Remove nonfunctional default sampling for WANObjectCache metrics.
  • (task T258851) Prevent service injection to LoadExtensionSchemaUpdates hook.
  • (task T270852) Hooks: Map dash character to underscore when generating hook names.
  • (task T271551, task T270145) Fix fetching ipblock-exempt within BlockManager::getUserBlock.
  • PHPVersionCheck: The PHP Group only supports PHP >= 7.3.0.
  • (task T248925) Set empty closures in DatabaseTest to fix PHP 8 tests.
  • (task T34217) rdbms: Remove outdated MySQL 4 references and fix doc URLs.
  • (task T248925) Special:Contributions reports negative namespace error on PHP 8.
  • (task T248925) objectcache: Fix non-numeric string check in HashBagOStuff for PHP 8.
  • (task T248925) Fix CacheTime::getCacheExpiry for PHP 8.
  • (task T259685) Allow REST API POST handlers to opt out of mandatory SQLite locking.
  • (task T91820, task T259685) MWLBFactory: rename magic HTTP header for opting out of SQLite write lock.
  • (task T272326) Fix DeprecationHelperTest on PHP 8.
  • Upgrade wikimedia/less.php from 3.0.0 to 3.1.0 for PHP 8.0 support.
  • (task T236639) OutputPage: Make $wgDebugRedirects work again.
  • (task T274648) registration: Allow reusing cached metadata between wikis.
  • CdnCacheUpdate: Send full URL instead of path to Curl for purge.
  • Upgrade monolog/monolog from 1.25.3 to 2.2.0 for PHP 8.0 support.
  • FileBackend: Do not use SOCKET_ENOENT on windows.
  • (task T275441) ApiQueryUserInfo: Allow all uiprops to be requested at once.
  • (task T275261) Escape wikitext in the title in invalid title error messages.
  • (task T275242) Extend iwlinks.iwl_prefix to VARBINARY(32) on MySQL.
  • (task T246594, task T270228) PHPVersionCheck: Complain about known-bad versions above minimum.
  • (task T275824) Upgrade wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1 for Composer 2.0 support.
  • (task T269293) Record all used options in metadata.
  • Allow usage of Composer 2.0 to install MediaWiki's dependencies.
  • (task T259872) skins: Call headElement() after getTemplateData() in SkinMustache.
  • (task T277009, CVE-2021-30158) SECURITY: Allow blocked users to access Special:ResetTokens.
  • (task T272412) Add "Account data" section to user preferences.
  • (task T268310) Add list of thumbnail urls to LocalFilePurgeThumbnails hook.
  • (task T277520) registration: Allow specifying immovable namespaces in extension.json.
  • (task T275619) Maintenance::hasOption and Maintenance::getOption now behave as documented and are not altered by previous calls to these methods.
  • (task T254688) Remove page inner join from subquery in SpecialWhatLinksHere.
  • (task T122124) signup: added help message for security.
  • (task T278014, CVE-2021-30154) SECURITY: Escape mediastatistics-header-* messages on Special:NewFiles.
  • (task T278058, CVE-2021-30157) SECURITY: Escape rcfilters-filter-* messages on ChangesList pages.
  • (task T277414) HTMLFormField: Use non namespaced class name rather than static::class.
  • (task T268673) maintenance: Don't create SearchUpdate in rebuildtextindex.php for page_namespace below 0.
  • (task T246594, task T270228) Mark ParserOptionsTests skipped on PHP 7.4.0-7.4.8.
  • (task T268230) Switch to new MediaWiki logo by Serhio Magpie.
  • (task T271735) Expand config-pingback-help, link to privacy policy in config-pingback.
  • Fix documentation of user-global in $wgRateLimits.
  • BackupDumper: Add -o as shortcode for --output.
  • (task T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
  • (task T270713, CVE-2021-30152) SECURITY: Allow user to only apply protection they have right to do so via action=protect.
  • (task T272386, CVE-2021-30159) SECURITY: Non-admin deleted enwiki page in fast double move.
  • (task T270988, CVE-2021-30155) SECURITY: ContentModelChange: Check that user cancreate pages.
  • (task T279451, CVE-2021-30458) SECURITY: Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags.

MediaWiki 1.35.1 edit

This is a security and maintenance release of the MediaWiki 1.35 branch.

While normally running update.php isn't required for point releases, it is recommended to run it for 1.35.1 so that sites.site_language is updated to take 35 characters.

Watchlist Expiry is no longer considered experimental, but is off by default. To enable it, set $wgWatchlistExpiry = true; in your LocalSettings.php.

Changes since MediaWiki 1.35.0 edit

  • (task T263929) purgeList.php Fix all-namespaces option to match one used in code.
  • (task T248719) ParserCache::get - fix wfDeprecated call.
  • (task T261430) WatchlistExpiryWidget: Move focus to expiry dropdown after hitting Tab.
  • Preload mediawiki.watchstar.widgets before api request.
  • (task T261030) ApiEditPage: Show existing watchlist expiry if status is not being changed.
  • (task T264502) Fix PHP 8 compat with strcspn() $length parameter exceeding string.
  • (task T248925) Remove final modifier on private function.
  • (task T264683) Remove ipb_anon_only from ipb_address_unique index addition.
  • (task T261415) Add days left messages to changes-lists' clock icons.
  • Fix order of wfDeprecated parameters in ExternalStoreDB::getSlave.
  • (task T261260) Preload class used in HeaderCallback.
  • (task T260868, task T260009) Normalize WatchedItem expiry field.
  • (task T264683) Remove doTable check from (Mysql|Sqlite)Updater::indexHasFields.
  • (task T264534) ApiPageSet: Avoid infinite loop when merging redirects.
  • (task T196906) Empty Monolog loggers are now real blackholes.
  • (task T258649) WatchAction: avoid UPDATE when old and new watch period is indefinite.
  • Parser: Adjust typehint to show that getTitle can return null.
  • (task T263592) media: Fix case of FlashPixVersion in FormatMetadata::makeFormattedData().
  • (task T265223) BaseTemplate: Guard against passing zero arg to array_merge().
  • (task T264965) Fix base path handling for MessagePosterModule registration.
  • (task T252183) Fix Database::getTempTableWrites for multi table DDLs.
  • (task T182546) Fix switch/case indentation per mediawiki coding conventions.
  • Flip Yoda conditionals.
  • (task T263213) Move SkinTemplate::getFooterLinks() to Skin.
  • build: Updating mediawiki/mediawiki-codesniffer to 33.0.0.
  • (task T267105) Make ImageBuilder::checkMissingImage public.
  • Updating guzzlehttp/guzzle (6.5.4 => 6.5.5).
  • (task T266681) Support new style hook registration on install and update.
  • (task T266980) Fix unsetting of copyright icon in FooterIcons.
  • upload.js: Don't assume that warnings array will include 'code' key.
  • upload.js: Fix typo in upload API.
  • (task T264333, task T190988, task T266903) Pass along ignorewarnings param to all individual chunks being uploaded.
  • (task T267558) importTextFiles.php: Replace deprecated WikiRevision:setText().
  • (task T266418) composer.json: add requirement for composer-plugin-api ^1.1.
  • (task T261431) Add ARIA attributes to watchlink and its notification.
  • (task T258877) Change invalid 'Content-Encoding: none' header.
  • Fix trailing ; in patch-sites-site_language-35.sql.
  • (task T248852) wfAssembleUrl: Handle empty query field in URL bits.
  • (task T268846) Updating wikimedia/testing-access-wrapper (1.0.0 => 2.0.0).
  • (task T268887) migrateComments: Cast array keys back to string before passing to the DB.
  • (task T266619) Introduce new $wgThumbPath config.
  • (task T269178) MemcachedClient: Cast Resource to integer.
  • (task T263925) Use the old HookContainer to set up the post-reset services.
  • Change "site cache" to just "cache" in the right-purge message.
  • [UploadedFileStreamTest] Skip test with chmod.
  • (task T269710) Updating composer/semver (1.5.1 => 1.7.2).
  • (task T269710) Updating mediawiki/mediawiki-codesniffer (33.0.0 => 34.0.0).
  • (task T260631, task T260633), BotPassword::save() now returns a Status object for the result rather than a bool. The length of the bot password grants and restriction fields are now validated, and an error will be thrown if it would be truncated by the database.
  • (task T265778) Fix English/*nix specific error messages in FSFileBackend.
  • (task T267543) Split dropping of image.img_user_timestamp.
  • [FileTest] Do not assume /tmp exists on windows.
  • Clean up temp files correctly after unit tests.
  • Skip undo related phpunit tests when diff3 is missing.
  • (task T269964) rdbms: Remove outer parentheses in insert query for Postgres.
  • (task T263911) In MWExceptionHandler::report(), catch all throwables.
  • (task T268894, CVE-2020-35474) SECURITY: Use Html::element in ChangeListSpecialPage for sanity.
  • (task T268917) Use Xml::element in SpecialUserrights for sanity.
  • (task T268938, CVE-2020-35478, CVE-2020-35479) SECURITY: Pass escaped html to LogFormatter::makePageLink for sanity.
  • (task T268938) Fixed mixed escaping in Language::translateBlockExpiry.
  • (task T263911) UserOptionsManager: don't differentiate anons caches.
  • (task T261260) HeaderCallback: pre-cache request ID.
  • Parsoid updated to v0.12.1.
  • (task T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log entries when MediaWiki:Mainpage uses Special:MyLanguage.
  • (task T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions and user pages of hidden users and missing users.
  • (task T270145) Fix condition that can lead to using APCOND_BLOCKED in $wgAutopromote to cause an OOM in PHP.

MediaWiki 1.35.0 edit

Changes since MediaWiki 1.35.0-rc.3 edit

  • (task T261258) Remove checks for ancient ImageMagick versions in BitmapHandler.
  • (task T260232) Don't include null page ids in query list for category dumps.
  • (task T260009) Check existing watchitem when saving action=watch.
  • (task T259055) Correct success messages for action=watch.
  • mediawiki.page.ready: Simpler tablesorter/makeCollapsible call.
  • mediawiki.page.ready: Fix skin override config flags, wrong way round.
  • (task T262175, task T248512) Remove requirement for ApiWatchlistTrait to be in ApiBase.
  • (task T259053, task T260434) Watchlist: Fix updateWatchLink removing css class when action=watch.
  • (task T261901, task T261476) mediawiki.notification: Don't close notif when clicking ‎<select> element.
  • (task T251506) Sanitizer: Truncate IDs to a reasonable length.
  • (task T259452) Parsoid updated to v0.12.0.
  • (task T261970) watch.ajax: Add expiry support to watchpage.mw event.
  • (task T262900) Fix failure of rebuildLocalisationCache.php due to ResourceLoader hook.
  • (task T263014) Hard deprecate File::userCan() with $user=null.
  • (task T262547) Use localized success message after watching via action=watch.
  • (task T201491) Fix typo 'Watchlst' in `apihelp-edit-param-watchlistexpiry`.
  • (task T261081) Installer: consistently reset Language objects.
  • (task T250449, task T250450) Installer: consistently reset Language objects.
  • Explicitly wrap some XML calls in libxml_disable_entity_loader().
  • (task T262934) Ensure dropdown label is always on its own line.
  • (task T246855) resourceloader: Use a local HookRunner.
  • (task T263604) Have findBadBlobs.php require Maintenance.php rather than cleanupTable.inc.
  • (task T263606) Set fake time, to avoid flaky tests.
  • (task T261325) Add FindMissingActors script.
  • (task T262364) shell: Don't blacklist /run/firejail.
  • (task T263655) NewPagesPager: Ignore nonexistent namespaces.
  • Update specialPageAliases and magicWords for Egyptian Arabic (arz).
  • (task T261347) ParserOutput: don't throw on bad editsection.
  • (task T232568, CVE-2020-25813) SpecialUserrights: If a viewer lacks `hideuser`, ignore hidden users.
  • (task T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on Special:Contributions.
  • (task T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within LogEventsList.
  • (task T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking firejail's --output functionality.
  • (task T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and 'style' attribute.
  • (task T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in mw.message( ... ).parse().
  • (task T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct database.
  • (task T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
  • Add Finnish special page aliases.
  • Fix GuzzleHttpRequest request headers.
  • Fix description for pruneFileCache.php.
  • emptyUserGroup.php: handle more than 5000 users.
  • Make ApiSandbox copyable URL absolute.
  • (task T261087) Add a link from a deleted page to that page's logs.

MediaWiki 1.35.0-rc.3 edit

Changes since MediaWiki 1.35.0-rc.2 edit

  • (task T258662) mediawiki.visibleTimeout: Update the nextVisibleTimeoutId value.
  • Ensure Parsoid doesn't throw when ‎<ref> is used w/o Cite installed.
  • Remove maintenance/createCommonPasswordCdb.php.
  • (task T260468) Increase "sites.site_global_key" to varbinary(64).
  • (task T183759) Fix shell edge-cases in Windows.
  • (task T257879) Drop PHP 7.2 support; require 7.3.19.
  • (task T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global rate limit type.
  • (task T246991) User: enforce pingLimiter() expiry time.
  • (task T256831) Rest: Handle Uri constructor exception.
  • (task T259094) Fix RequestFromGlobalsTest failing in Travis CI.
  • (task T256831, task T261344) Rest: Use try/catch to handle URIs with embedded colon.

MediaWiki 1.35.0-rc.2 edit

Changes since MediaWiki 1.35.0-rc.1 edit

  • (task T259693) uuid: Fix filenames on Windows.
  • Remove Gruntfile.js and package-lock.json from the tarball.
  • firejail: Strengthen by copying from Wikimedia's profile.
  • (task T260059) ResourceLoaderOOUIImageModule: loadOOUIDefinition() may return false.
  • (task T30162, task T245387) The installer supports using a Postgres server running on a custom port other than 5432.
  • (task T260201) Support private wikis in Parsoid zero configuration mode.
  • Fix bad use of `|=` PHP bit operation where `= … ||` bool is intended.
  • (task T259212) SpecialBlock: Show error if a block could not be inserted or found.
  • (task T255842) UserOptionsManager: fix options reset.
  • (task T258649) WatchAction: avoid unnecessary UPDATEs when expiry is unchanged.
  • (task T250851) Allow skins to override mediawiki.page.ready initialisation.
  • (task T250851) mediawiki.page.ready: Allow skins to disable search lazy load.
  • (task T253135, task T255632) Update language in watchlist expiry.
  • Use IPset in MWRestrictions::checkIP.
  • (task T259564) Fix race condition on edit page.
  • (task T260759) Hide watchlist expiry label in edit form.
  • mime: Fix docs of MIME_EXTENSIONS, they're arrays, not space-seperated.
  • (task T260031) Add application/font-sfnt to MimeMap for ttf files.
  • (task T259379) WatchedItemStore: Cache single WatchedItems with preexisting expiry.
  • Add a maintenance script to create bot passwords.
  • (task T201269) Add Traditional Chinese zh-hant as fallback for Amis (ami).
  • Improve wfParseUrl docs.
  • (task T251038) Add multi index fields in ImageListPager for unique paginate.
  • (task T259916) Guard against 'Widget not found' error.

MediaWiki 1.35.0-rc.1 edit

Changes since MediaWiki 1.35.0-rc.0 edit

  • (task T252136) Fix RecentChanges watchlist filters when WatchlistExpiry is off.
  • (task T258662) Update time period for watchlist expiry pop-up.
  • (task T258443) Fix expiry dropdown not getting disabled on edit page.
  • (task T259398) Add license information for promise-polyfill.
  • Remove executable bit from scripts without shebang.
  • (task T256526) Fix bold of watched items on Special:RecentChangesLinked.
  • (task T259060) Edit page expiry dropdown should keep state after disabling/enabling.
  • (task T259009) Translate expiry period in pop-up message for watchlist expiry.
  • (task T258310) Add watchlist clock icon to RecentChanges.
  • (task T259362) Permit temporary table writes on replica DB connections.
  • (task T250214) Add UI support in Special:EditWatchlist for watchlist expiry.
  • (task T72470) Disable wgLegacyJavaScriptGlobals by default.
  • (task T130906) Add Edge to MediaWiki:Clearyourcache.
  • (task T257279) Add mediawiki.ui Less variable deprecation note.
  • (task T249521) Fixed reassignEdits.php to work with anonymous users.
  • (task T259448) Fix Circular dependency when creating service in DBLoadBalancerFactory.
  • (task T257259) Default to using watchlist expiry of old page when moving pages.

MediaWiki 1.35.0-rc.0 edit

Upgrading notes for 1.35 edit

1.35 requires PHP 7.3.19 or above (up from 7.2.9). (task T257879)

1.35 has several database changes since 1.34, and will not work without schema updates. Note that due to changes to some very large tables like the revision table, the schema update may take quite long (minutes on a medium sized site, many hours on a large site).

Don't forget to always back up your database before upgrading!

MediaWiki 1.35 is the next LTS after 1.31, and will be supported for around 3 years.

MediaWiki has a lot of both soft and hard deprecations, and code removed. As always, make sure your versions of extensions match the MediaWiki version, and updates may be required to any custom extensions.

See the file UPGRADE for more detailed upgrade instructions, including important information when upgrading from versions prior to 1.11.

Some specific notes for MediaWiki 1.35 upgrades are below:

  • (task T259685) Zeroconf (zero-configuration) VisualEditor/Parsoid doesn't work using SQLite as the database backend for MediaWiki. This is due to the lack of write concurrency in SQLite. If you wish to use this feature, it is recommended to use MySQL/MariaDB rather than SQLite.

For notes on 1.34.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.35 edit

New configuration edit

  • $wgDiffEngine — This can be used to specify the difference engine to use, rather than MediaWiki choosing the first of $wgExternalDiffEngine , wikidiff2, or php that is usable.
  • $wgSearchMatchRedirectPreference — This configuration setting controls whether users can set a new preference, search-match-redirect, which decides if search should redirect them to exact matches is available. By default, this is set to false, which maintains the previous behaviour without preference bloat. Change your site's default by setting $wgDefaultUserOptions ['search-match-redirect'].
  • $wgPoolCounterConf ['SpecialContributions'] — Per-user concurrency in the use of SpecialContributions can now be limited by setting this appropriately.
  • $wgPasswordPolicy — PasswordCannotBeSubstringInUsername is a new password policy check. Similar to the existing PasswordCannotMatchUsername check, this check ensures that a user's (case-insensitive) password cannot be a part of their username. e.g. password = MyPass, username = ThisUsersPasswordIsMyPass.
  • $wgLogos — This new configuration setting combines the now-deprecated $wgLogo and $wgLogoHD settings into a single, associative array. It provides support for a new key, 'wordmark', for setting a horizontal wordmark to show next to the graphical logo. To do this, set 'wordmark' to an array with 'src' set to the path of the wordmark image, and 'width' and 'height' for its dimensions in pixels. $wgLogos inherits the existing support provided by its predecessor settings: '1x' mapping to the path of the logo as a 135x135px raster image (equivalent to $wgLogo ), and '1.5x', '2x', and 'svg' operating as before for $wgLogoHD . If $wgLogos is unset, $wgLogo and $wgLogoHD values are read for temporary backwards compatibility. (task T232140)
  • $wgWatchlistExpiry — (EXPERIMENTAL) This enables the new watchlist expiry feature. The database table (watchlist_expiry) for this is created regardless of this setting, but all other aspects of the expiry feature are controlled by it. Enabling in production is discouraged for the time being. A future MediaWiki 1.35 release will advertise this feature once it is stable.
  • $wgWatchlistPurgeRate — This sets the chance of expired watchlist items being purged on each page edit. Only has effect if $wgWatchlistExpiry is true.
  • $wgWatchlistExpiryMaxDuration — This is the maximum definite relative duration for watchlist expiries. Only has effect if $wgWatchlistExpiry is true.
  • $wgImgAuthPath – This can be used to override the path prefix used when handling img_auth.php requests. (task T235357)
  • $wgAllowedCorsHeaders — This is a list of headers which can be used in a cross-site API request.
  • $wgHTTPMaxTimeout and $wgHTTPMaxConnectTimeout — These allow site administrators to limit the timeouts used by the HTTP client libraries. This only affects callers using HttpRequestFactory and the deprecated wrappers in the Http class.
  • $wgCdnMaxageStale — This controls the Cache-Control s-maxage header for page views when PoolCounter lock contention indicates that a stale cache entry should be sent.
  • $wgForceHTTPS — This makes the HTTP to HTTPS redirect be unconditional and suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We recommend this be set to true on pure HTTPS wikis.
  • $wgCookieSameSite — This setting allows login cookies to be sent with SameSite=None. This is required for cross-site CentralAuth auto-login after Chrome 84.
  • $wgUseSameSiteLegacyCookies — This adds a compatibility hack to SameSite=None cookies for browsers which implemented an incompatible draft version of the specification.

Changed configuration edit

  • $wgResourceLoaderMaxage (task T235314) — This configuration array controls the max-age for HTTP caching through the Cache-Control header. It has uses the "versioned" key for urls that do have a version parameter, and the "unversioned" key for urls without a version parameter. The sub keys for "client" and "server" are no longer supported in MediaWiki 1.35.
  • $wgEnableOpenSearchSuggest — This boolean variable is deprecated and no longer used. The OpenSearch API is now always enabled.
  • $wgAuthManagerConfig and $wgAuthManagerAutoConfig — These can now use the 'services' option in provider specifications.
  • $wgVirtualRestConfig ['modules']['parsoid'] —
    • The defaults have been updated. If you were relying on the default values, you may need to update your configuration.
    • The 'URL' parameter, previously allowed for backwards-compatibility, has been deprecated. Use 'url' instead.
  • $wgXmlDumpSchemaVersion — Default is now set to XML_DUMP_SCHEMA_VERSION_11, so dumps use the new dump format per default. Consumers of XML dumps should not be affected if they ignore any unknown tags they encounter. Also, the format is effectively unchanged for revisions that only contain the main slot. The --schema-version option can be used with the dumpBackup.php script to set the dump format. (task T238921)
  • $wgParserConf — This configuration is now deprecated. It has been effectively constant since 2008, and is ignored by core code. Configure the ParserFactory service in order to customize the Parser used.
  • $wgAutoloadAttemptLowercase — This has been deprecated, and the default value changed to false.
  • $wgAllowImageMoving — This configuration setting is now deprecated. Instead, use $wgGroupPermissions ; e.g., to revoke sysops' ability to move images use $wgGroupPermissions ['sysop']['movefile'] = false.
  • $wgAllowImageTag — This configuration is now deprecated; future parsers will not support direct use of the HTML ‎<img> tag in wikitext.
  • $wgUseTwoButtonsSearchForm — This has been deprecated. If you maintain a skin that relies on this and wishes to let system administrators change it, you should convert it to a config variable specific to your skin. If you're using it to configure your wiki, you should check individual skins to see whether they have local skin config for the feature and use that.
  • $wgPasswordPolicy — The deprecated policy 'PasswordCannotBePopular' has been removed. Use PasswordNotInCommonList instead which covers many more passwords.
  • Backwards compatibility for using an associative array (e.g. [ '127.0.0.1' => 'bad-ip' ]) for $wgProxyList has been removed. This was deprecated since 1.30. Please convert these arrays to indexed/sequential ones (e.g. [ '127.0.0.1' ]).
  • $wgShellRestrictionMethod — This now defaults to 'autodetect', which will enable sandboxing for shell commands using firejail, if it's installed. To disable restrictions, set it to false.
  • $wgLegacyJavaScriptGlobals – This deprecated setting now default to false, instead of true, ahead of its planned removal.

Removed configuration edit

New user-facing features in 1.35 edit

  • (task T204618) Whitelisted the aria-hidden HTML attribute for all elements in wikitext.
  • (task T13456) Special:EditPage, Special:PageHistory, Special:PageInfo, and Special:Purge have been created as shortcuts for each action. Special:EditPage/Foo redirects to title=foo&action=edit, with PageHistory, PageInfo, and Purge corresponding to action= history, info, and purge respectively. When linked to, its subpage is used as the target. Otherwise, it displays a basic interface to allow the end user to specify the target manually.
  • (task T139221) The generated table of contents is now a navigation landmark role for assistive technologies.
  • (task T245931) interwiki map API doesn't report foreign language if $wgInterwikiMagic =false
  • The form at ?action=watch has a new dropdown list to support expiry dates for watchlist items (if $wgWatchlistExpiry is true).

New developer features in 1.35 edit

  • A Docker based local development develpoment environment configuration is included (task T238224) and DEVELOPERS.md has been added with usage documentation and links to further help.
  • If CSP is enabled, extensions can now add additional sources using the ContentSecurityPolicy::addDefaultSource, ::addStyleSrc and ::addScriptSrc methods (e.g. $context->getOutput()->getCSP()->addDefaultSrc( 'example.com' ))
  • Extensions can now specify classes and namespaces to be autoloaded by the test autoloader, by setting the "TestAutoloadNamespaces" and "TestAutoloadClasses" properties in extension.json. (task T196090)
  • (task T250977) extension.json now allows "SearchMappings" which maps the canonical name of the search engine (used in wgSearchType and wgSearchTypeAlternatives) to a specification using the ObjectFactory specification. This allows extensions to register Search Engines using namespaced classes.
  • Added getters for OutputPage's robot, index and follow policies; getRobotPolicy() returns the entire policy as a string in the form <index policy>,<follow policy> while getIndexPolicy() and getFollowPolicy() return their respective policies as a string.
  • The ResourceLoaderSiteModulePages and ResourceLoaderSiteStylesModulePages hooks were added to allow changing which wiki pages these modules contain.
  • The SkinFactory now allows skins to be specified as an ObjectFactory spec, allowing the construction of skins with services injected.
  • ContentHandlerFactory for most ContentHandler static methods. It has been added to the constructors for many classes to improve SOLID / GRASP.
  • FileDeleteForm's constructor now accepts a user as the second parameter. Support for not passing a user has also been hard-deprecated and will be removed in 1.36.
  • The ParserPreSaveTransformComplete hook was added.
  • The ParserBeforePreprocess hook was added.
  • The ResourceLoaderSkinModule class now has a "legacy" feature that loads the stylesheets previously part of the "mediawiki.legacy.shared" and "mediawiki.legacy.commonPrint" module. Those modules are now deprecated and no longer loaded by skins. For skins needing to retain these styles, you will need to load these styles via a module using the ResourceLoaderSkinModule class. See Vector and Monobook for examples.
  • ParserOutput now has methods addExtraCSPStyleSrc, addExtraCSPDefaultSrc, addExtraCSPScriptSrc for parser tags/functions to be able to add sources to the Content Security Policy.
  • The HtmlCacheUpdater service was added to unify the logic of purging CDN cache and HTML file cache to simplify callers and make them more consistent.
  • The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
  • Preferences which use HTMLTitlesMultiselectField can make use of MultiTitleFilter class for saving title text to/from article IDs in user preferences.
  • OutputPage::addHtmlClasses() was added to allow injecting CSS classes on to the ‎<html> element on page load.
  • The SkinAddFooterLinks hook is added to allow extensions to add items to skin footers. Previously this had to be done via SkinTemplateOutputPageBeforeExec . Doing so using that hook is now hard deprecated.
  • A new BlockPermissionChecker service was introduced for checking block-related permissions.
  • The support of 'database' type of extensions has been added to allow 3d party databases like Percona be used as storage. See task T226857, task T253248.
  • Three new return parameters have been added to the EditPageGetCheckboxesDefinition hook. Handlers of this hook are no longer restricted to defining checkboxes. See the documentation of EditPage::getCheckboxesDefinition() for more details.
  • New flag File::RENDER_TMP was added in order to allow File::generateAndSaveThumb and File::trasform to render a thumbnail without saving it to the storage.

External library changes in 1.35 edit

New external libraries edit

New development-only external libraries edit

Changed external libraries edit

Changed development-only external libraries edit

Removed external libraries edit

  • phpunit/php-invoker (dev-only). Removing this unbreaks development on Windows systems, in exchange for losing time limits in running unit tests.
  • The jquery.getAttrs module was removed.

Action API changes in 1.35 edit

  • The 'suggest' parameter of action=opensearch has been deprecated. The API behaves the same with and without this parameter. It was previously used by $wgEnableOpenSearchSuggest to partially disable the API if set to false. Specifically, it would deny internal frontend requests carrying this parameter, whilst accepting other requests.
  • Integer-type parameters are now validated for syntax rather than being interpreted in surprising ways. For example, the following will now return a badinteger error:
    • "1.9" (formerly interpreted as "1")
    • " 1" (formerly interpreted as "1")
    • "1e1" (formerly interpreted as "1" or "10", depending on the PHP version)
    • "1foobar" (formerly interpreted as "1")
    • "foobar" (formerly intepreted as "0") parameters. Ranges should be assumed to be enforced.
  • Many user-type parameters now accept a user ID, formatted like "#12345".
  • The 'assert' parameter used by all API modules now supports the value 'anon'. When specified, the API will return the 'assertanonfailed' error if the user is logged in.
  • action=edit now supports the 'baserevid' parameter for edit conflict detection, as an alternative to 'basetimestamp'. Note that self-conflicts will continue to be ignored if 'basetimestamp' is set, but not if only 'baserevid' is set.
  • A new module was added to change the content model of existing pages. Use action=changecontentmodel. Unlike Special:ChangeContentModel, the api module does not work for pages that do not already exist.
  • If $wgWatchlistExpiry is true, the following API changes are made:
    • action=watch accepts a new 'expiry' parameter analagous to the expiry accepted by action=userrights, action=block, etc., except it must be no greater than $wgWatchlistExpiryMaxDuration , or an infinity value.
    • action=query&list=watchlistraw returns pages' watchlist expiry dates.
  • (task T249526) action=login will now return Failed rather than NeedToken on session loss.

Action API internal changes in 1.35 edit

  • The Action API now uses the Wikimedia\ParamValidator library for parameter validation, which brings some new features and changes. For the most part existing module code should work as it did before, but see subsequent notes for changes.
    • The values for all ApiBase PARAM_* constants have changed. Code should have been using the constants rather than hard-coding the values.
    • Several ApiBase PARAM_* constants have been deprecated, see the in-class documentation for details. Use the equivalent ParamValidator constants instead.
    • The value returned for 'upload'-type parameters has changed from WebRequestUpload to Psr\Http\Message\UploadedFileInterface.
  • Validation of 'user'-type parameters is more flexible. PARAM constants exist to specify the type of "user" allowed and to request UserIdentity objects rather than name strings. The default is to accept all types (name, IP, range, and interwiki) that were formerly accepted.
  • Maximum limits are no longer ignored in "internal mode".
  • The $paramName to ApiBase::handleParamNormalization() should now include the prefix.
  • (task T245931) meta=siteinfo&siprop=interwikimap no longer reports language or extralanglink when $wgInterwikiMagic is false.

Languages updated in 1.35 edit

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

  • The default targets for the ISBN search from Special:BookSources in English have been updated for better international suppport. They will now be BetterWorldBooks.com, OpenLibrary.org and Worldcat.org.
  • (task T237672) Changed the Moroccan Arabic language (ary) to the Arabic script.
  • (task T201269) Added language support for Amis (ami).
  • (task T248299) Added language support for Inari Sami (smn).
  • (task T251369) Added language support for Ladin (lld).
  • (task T251369) Added language support for Seediq (trv), also known as Taroko.

Breaking changes in 1.35 edit

  • MediaWiki no longer supports PHP 7.2; use PHP 7.3.19+ (task T228346, task T257879).
  • ResourceLoader::getLessVars(), deprecated in 1.32, was removed. Use ResourceLoaderModule::getLessVars() instead.
  • The jquery.tabIndex module, deprecated in 1.34, has been removed.
  • The mediawiki.RegExp module alias, deprecated in 1.34, was removed. Use the mediawiki.util module instead.
  • The easy-deflate.inflate module, unused since 1.32, was removed.
  • The easy-deflate.deflate module was removed. Use the mediawiki.deflate module instead.
  • The mediawiki.notify module was removed. The mw.notify() shortcut is now available by default, without any dependency.
  • (task T219604) The "jquery.ui.*" and "jquery.effects.*" module aliases, deprecated in 1.34, have been removed. Use "jquery.ui" instead.
  • (task T235457) The "user.tokens" module has been removed. Use "user.options" instead.
  • (task T251855) The mw.Map#exists method in JavaScript no longer supports checking multiple keys. This affects mw.config.exists() and mw.user.tokens.exists().
  • The internal variable $constructorOptions for the Parser & SpecialPageFactory, exposed only for integration purposes, are now each replaced by a const called CONSTRUCTOR_OPTIONS. This was a breaking change made without deprecation.
  • ObjectCache::getWANInstance, deprecated in 1.34, was removed. Use MediaWikiServices::getMainWANObjectCache instead.
  • ObjectCache::newWANCacheFromParams, deprecated in 1.34, was removed. Construct WANObjectCache directly instead, or use MediaWikiServices.
  • (task T231366) The ProfilerOutputDb class and profileinfo.php entry point, deprecated in 1.34, was removed.
  • SiteConfiguration->localVHosts, deprecated in 1.25, was removed. Use $wgLocalVirtualHosts instead.
  • The $wgContLanguageCode read-only variable was removed. It has been a non-configurable copy of $wgLanguageCode since MW 1.8 (2006). Use $wgLanguageCode directly instead.
  • ApiQueryUserInfo::getBlockInfo, deprecated in 1.34, was removed. Use ApiBlockInfoTrait::getBlockDetails instead.
  • Password::equals(), deprecated in 1.33, was removed. Use Password::verify().
  • QuickTemplate::setRef(), deprecated in 1.31, was removed. Use set().
  • The mediawiki.ui.text module, deprecated in 1.28 and unused, was removed.
  • AbstractBlock::mReason, deprecated in 1.34, is no longer public.
  • The GetBlockedStatus and UserIsHidden, deprecated in 1.34, has been removed. Instead, use the GetUserBlock hook.
  • As part of work to replace the Parser, a large number of breaking changes have been made, principally in related methods and properties being removed or made private:
    • disableCache(), deprecated in 1.28.
    • serializeHalfParsedText() and the helpers unserializeHalfParsedText(), isValidHalfParsedText(), and StripState::getSubState() and StripState::merge(), all deprecated in 1.31. The helper functions LinkHolderArray::mergeForeign() and LinkHolderArray::getSubArray() were also removed.
    • getConverterLanguage(), deprecated in 1.32. Use getTargetLanguage() instead.
    • A large set of methods exposed only for historical reasons, deprecated in 1.34, have now been removed or made private:
      • areSubpagesAllowed()
      • armorLinks()
      • createAssocArgs()
      • doAllQuotes()
      • doDoubleUnderscore()
      • doHeadings()
      • doMagicLinks()
      • formatHeadings()
      • getImageParams()
      • getVariableValue()
      • initialiseVariables()
      • makeKnownLinkHolder()
      • maybeDoSubpageLink()
      • parseLinkParameter()
      • replaceExternalLinks()
      • replaceInternalLinks()
      • replaceInternalLinks2()
      • replaceLinkHoldersText().
      • splitWhitespace()
      • stripAltText()
      • testPreprocess()
      • testPst()
      • testSrvus()
    • incrementIncludeSize(), setTransparentTagHook(), replaceTransparentTags(), and $mTransparentTagHooks have been removed without deprecation.
    • The following constants have been made private without deprecation:
      • ::EXT_LINK_ADDR
      • ::EXT_IMAGE_REGEX
      • ::SPACE_NOT_NL
    • The following properties have been removed without deprecation:
      • ::$mDefaultStripList
      • ::$mIncludeCount
      • ::$mRevIdForTs
    • The following properties have been made private without deprecation:
      • ::$mFunctionSynonyms
      • ::$mFunctionTagHooks
      • ::$mStripList
      • ::$mVarCache
      • ::$mImageParams
      • ::$mImageParamsMagicArray
      • ::$mSubstWords
      • ::$mVariables
      • ::$mConf (deprecated in 1.34)
      • ::$mExtLinkBracketedRegex
      • ::$mUrlProtocols
      • ::$mAutonumber
      • ::$mLinkHolders
      • ::$mDefaultSort
      • ::$mTplRedirCache
      • ::$mForceTocPosition
      • ::$mTplDomCache
      • ::$mOutputType
      • ::$mLangLinkLanguages
      • ::$currentRevisionCache
      • ::$mProfiler
      • ::$mLinkRenderer
    • Parser::getTitle() will now throw a TypeError if $mTitle is uninitialized. This use pattern was deprecated in 1.34.
    • ContentHandler::makeParserOptions(), deprecated in 1.32, was removed. Use WikiPage::makeParserOptions() or ParserOptions::newCanonical() instead.
    • The ParserAfterUnstrip hook, believed to be unused, was removed without deprecation.
    • Preprocessor_DOM and related classes, deprecated in 1.34, have been removed. Consequently, the related ParserOptions::getMaxGeneratedPPNodeCount() and ::setMaxGeneratedPPNodeCount() have been removed without deprecation.
    • The support for the old signature for ParserFactory::__construct, which was deprecated in 1.34, has been removed.
    • Parser::getDefaultPreprocessorClass(), deprecated in 1.34, has been removed.
  • MediaWikiTestCase::prepareServices(), deprecated in 1.32, has been removed
  • The method ContentHandler::getSlotDiffRendererInternal is replaced with ContentHandler::getSlotDiffRendererWithOptions. This breaks consumers which call parent::getSlotDiffRendererInternal (no instances of which are known).
  • TextContent::getHighlightHtml, deprecated since 1.24, has been removed. Use TextContent::getHtml instead.
  • ExtensionRegistry::load(), deprecated in 1.34, was removed. Instead, use ExtensionRegistry::queue().
  • MWMessagePack class, deprecated in 1.34, was removed.
  • The cdb.php maintenance script was removed. Use the 'cdb' command from the wikimedia/cdb library instead.
  • User::addNewUserLogEntryAutoCreate, deprecated in 1.27, was removed.
  • FileBasedSiteLookup class, deprecated in 1.33, was removed.
  • The wfGlobalCacheKey global function, deprecated in 1.30, was removed.
  • The APCBagOStuff class was removed. MediaWiki requires PHP 7.2+ (support for HHVM was dropped) and these versions of PHP only support apcu. The default "apc" entry in $wgObjectCaches now refers to APCUBagOStuff.
  • Database::bufferResults(), deprecated in 1.34, has been removed.
  • CannotReplaceActiveServiceException, ContainerDisabledException, DestructibleService, NoSuchServiceException, SalvageableService, ServiceAlreadyDefinedException, ServiceContainer and ServiceDisabledException in the global namespace, deprecated in 1.33, were removed. Use the classes in the MediaWiki\\Services namespace instead.
  • The following methods in the Interwiki class were removed: ::fetch(), ::isValidInterwiki(), ::invalidateCache(), and ::getAllPrefixes().
  • The UsersMultiselectWidget config 'allowArbitrary' is now false by default. To accept arbitrary entries, pass in true for this config.
  • OutputPage::parse() and OutputPage::parseInline(), deprecated in 1.32, have been removed. Use ::parseAsContent() or ::parseAsInterface(), as appropriate.
  • WikiPage::selectFields, deprecated in 1.31, was removed. Use ::getQueryInfo.
  • The remaining static methods for MagicWord, deprecated in 1.32, were removed. These were MagicWord::get(), ::getSubstIDs(), ::getDoubleUnderscoreArray(), ::getVariableIDs(), and ::getCacheTTL(). Instead, use MagicWordFactory (via MediaWikiServices).
  • ApiBase::checkTitleUserPermissions no longer accepts a User as the third parameter. Passing a user was deprecated in 1.33.
  • Sanitizer::setupAttributeWhitelist() and Sanitizer::attributeWhitelist(), deprecated in 1.34, have been removed. They should not have been public.
  • Passing a sequential array as the second parameter to Sanitizer::validateAttributes() has been deprecated; use an associative array where keys are the allowed attributes.
  • The $warnCallback parameter to Sanitizer::removeHTMLtags, deprecated since its introduction in 1.28, has been removed.
  • SpecialRecentChanges::filterByCategories(), deprecated in 1.31, was removed.
  • The `ArticleContentViewCustom` hook, deprecated in 1.32, was removed.
  • AuthManager::callLegacyAuthPlugin, deprecated in 1.33, was removed.
  • wfGetMessageCacheStorage was removed without deprecation.
  • Title::moveSubpages, deprecated in 1.34, was removed. Use the MovePage class and MovePage::moveSubpages instead.
  • Article::doEditContent, deprecated in 1.29, was removed. Instead, use WikiPage::doEditContent.
  • CommentStore::newKey, deprecated in 1.31, was removed.
  • EditPage::$hookError was changed from public to private.
  • Title::isValidMoveOperation, ::moveTo, and ::isValidMoveTarget, deprecated in 1.25, were removed. Use the MovePage class and its methods instead.
  • Title::getUserCaseDBKey(), deprecated in 1.33, was removed. Use ::getDBkey().
  • StringUtils::explodeMarkup() was removed without deprecation.
  • AjaxResponse methods that were unused have been removed without deprecation:
    • checkLastModified
    • loadFromMemcached
    • storeInMemcached
    • setCacheDuration
    • setVary
  • ApiDelete::delete and ::deleteFile, both of which were protected methods, have been made private to allow a signature change.
  • HistoryPager::revLink, ::curLink, ::lastLink, and ::diffButtons, which had no visibilities defined, have been made private to allow signature changes.
  • SpecialNewpages::revisionFromRcResult, which previously was protected, has been made private to allow a signature change.
  • DifferenceEngine::$mOldRev and $mNewRev, deprecated for public access in 1.32, have been removed.
  • DifferenceEngine::revisionDeleteLink, which was previosuly protected, has been made private to allow a signature change.
  • DifferenceEngine::getParserOutput, which is protected, has had a breaking signature change: the second parameter must be a RevisionRecord object, rather than a Revision object.
  • WikiPage::setLastEdit, which was previously protected, has been made private to allow a signature change.
  • Skin::getSkinNameMessages() deprecated in 1.34, has been removed.
  • Skin::escapeSearchLink() deprecated in 1.34, has been removed, use Skin::getSearchLink() instead.
  • Skin::shouldPreloadLogo() deprecated in 1.32, has been removed.
  • Revision::loadFromId and RevisionStore::loadRevisionFromId have been removed.
  • OutputPage::parserOptions doesn't accept an $options parameter anymore.
  • MessageCache::getParserOptions previously did not have a visibility set. It has been made private.
  • SpecialUndelete::showDiff previously did not have a visibilty set. It hav been made private to allow a signature change.
  • The Skin no longer loads the "mediawiki.legacy.shared" or "mediawiki.legacy.commonPrint" modules. The legacy shared styles must now be loaded by the skin explicitly, either inherited via the "mediawiki.skinning.*" modules, or by making your skin's main styles module use the ResourceLoaderSkinModule class with the "legacy" attribute. See Vector and Monobook for examples.
  • Passing an ApiMain to the constructor of ApiResult is no longer supported. This was deprecated in 1.25.
  • ResourceLoaderWikiModule::invalidateModuleCache has been declared to be @internal as part of a signature change. No known uses exist outside of MediaWiki core.
  • The ArticleAfterFetchContentObject hook, deprecated in 1.32, was removed. Use ArticleRevisionViewCustom to control output.
  • DatabaseBlock::isValid, deprecated in 1.33, was removed.
  • HTMLUserTextField and HTMLUsersMultiselectField previously implied required=true when exists=true. Form fields that use exists=true should also set required=true if they are required.
  • In DatabaseUpdater, the following methods are no longer public: dropTable(), modifyTable(), modifyField(), runMaintenance(), copyFile(), appendLine(). In PostgresUpdater, the following methods are no longer public: addPgEnumValue(), addPgIndex(), addPgExtIndex(). This change was made without deprecation due to immediate danger of data corruption and loss, see task T157651. Extensions should instead use dropExtensionTable(), modifyExtensionExtensionTable(), modifyExtensionField(), addExtensionUpdate(). The addExtensionUpdate() method can still be used to access any of the protected methods on DatabaseUpdater.
  • ResourceLoader no longer provides the (always-true) variables for wgEnableAPI and wgEnableWriteAPI; they were deprecated in MediaWiki 1.31 and removed from the PHP environment in MediaWiki 1.32.
  • The wfSetupSession global function, deprecated in 1.27, was removed. Use the persist() method of the right MediaWiki\Session\SessionManager object instead.
  • The wfIsHHVM global function, deprecated in 1.34, was removed.
  • GenderCache::doTitlesArray no longer accepts string values in its $titles array parameter. Use Title objects (or other LinkTarget) instead.
  • Unused CommentStore::MAX_COMMENT_LENGTH has been removed.
  • User::checkTemporaryPassword() and User::checkPassword(), deprecated in 1.27, were removed. Use AuthManager instead.
  • All constants and class functions now have explicit visibility modifiers. This means, per mw:Stable interface policy, that these should now be considered stable. This also helps MW align with PSR 2 and PSR 12. This was done based on audits of the corpus of skins and extensions hosted in Gerrit. If you find any that you need to be less restrictive (i.e. public or protected), please report these so that we can re-evaluate or suggest workarounds.
  • BaseTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg() or ->getMsg() instead.
  • QuickTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg() instead.
  • WebInstaller::getErrorBox() and ::getWarningBox(), deprecated in 1.34, were removed. Use Html::errorBox() or ::warningBox() instead.
  • SpecialVersion::getExtensionCredits() and SpecialVersion::getSkinCredits() have become private without deprecation.
  • As part of the migration to a new hook system (task T240307), the following classes now require an additional HookContainer constructor parameter:
    • AuthManager
    • BadFileLookup
    • BlockManager
    • ClassicInterwikiLookup
    • ContentHandlerFactory
    • ContentSecurityPolicy
    • DefaultOptionsManager
    • DerivedPageDataUpdater
    • FullSearchResultWidget
    • HtmlCacheUpdater
    • LanguageFactory
    • LanguageNameUtils
    • LinkRenderer
    • LinkRendererFactory
    • LocalisationCache
    • MagicWordFactory
    • MessageCache
    • NamespaceInfo
    • PageEditStash
    • PageHandlerFactory
    • PageUpdater
    • ParserFactory
    • PermissionManager
    • RevisionStore
    • RevisionStoreFactory
    • Router
    • SearchEngineConfig
    • SearchEngineFactory
    • SearchFormWidget
    • SearchNearMatcher
    • SessionBackend
    • SpecialPageFactory
    • UserNameUtils
    • UserOptionsManager
    • WatchedItemQueryService
    • WatchedItemStore
  • The following classes now require setHookContainer() to be called after construction:
    • AuthenticationProvider
    • ResourceLoaderModule
    • SearchEngine
  • The parameters to ChronologyProtector::getTouched() and ILBFactory::getChronologyProtectorTouched() were changed without backwards compatibility.
  • The deprecated $blacklist parameter to wfIsBadImage() has been removed.
  • SpecialBlock::checkUnblockSelf no longer accepts an integer representing an user ID as part of ongoing refactoring of SpecialBlock class.
  • User::setInternalPassword() and User::setPassword(), deprecated in 1.27, have been removed. Use User::changeAuthenticationData() instead.
  • User::selectFields(), deprecated in 1.31, has been removed. Use User::getQueryInfo() instead.
  • The "legacy" serialization type in RESTBagOStuff, deprecated in 1.34, has been removed.
  • The populateContentModel.php maintenance script was removed. It has been replaced by the populateContentTables.php script.
  • The findHooks.php maintenance script, for the old hooks system, was removed.
  • (task T257278) Calling MediaWiki\Shell\Command::restrict() will now overwrite any previous restrictions rather than adding to them, making it possible to disable the default restrictions.

Deprecations in 1.35 edit

  • The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4, is now deprecated. MediaWiki support for PHPUnit 4 ended with the removal of HHVM support.
  • LockManagerGroup::getDefault() and LockManagerGroup::getAny() are deprecated. They seem to be unused. Just use get() directly, and catch any exception.
  • AbstractBlock::getPermissionsError and AbstractBlock::getBlockErrorParams are deprecated. Use BlockErrorFormatter::getMessage instead.
  • The IP class is deprecated. Please instead use the Wikimedia\IPUtils class from the new wikimedia/ip-utils library instead. Additionally, the RE_IP_* constants are also deprecated. RE_IP_BYTE can be replaced with a class constant on the IPUtils class, while the others will eventually be made private.
  • The following Language methods are deprecated: getFallbackFor, getFallbacksFor, getFallbacksIncludingSiteLanguage. Use the corresponding new methods on the LanguageFallback class: getFirst, getAll, and getAllIncludingSiteLanguage.
  • FileJournal::factory is deprecated. Use the constructor directly instead.
  • AbstractBlock methods setBlocker(), getBlocker() are deprecated and will become internal implementation of DatabaseBlock.
  • Title::countRevisionsBetween has been deprecated and moved into RevisionStore.
  • FileBackendGroup::singleton() is deprecated. Use MediaWikiServices instead.
  • FileBackendGroup::destroySingleton() is deprecated. Test frameworks should instead reset MediaWikiServices between test runs. (MediaWikiIntegrationTestCase does this automatically.)
  • GenderCache::singleton(), deprecated in 1.28, is hard deprecated. Use MediaWikiServices::getGenderCache() instead.
  • MediaWikiIntegrationTest::setContentLang() has been deprecated. Use setMwGlobals( 'wgLanguageCode', 'xxx' ) to set a different site language code, or setService( 'ContentLanguage', $myObj ) to set a specific Language object. Service resets and $wgContLang will be handled automatically.
  • MediaWikiIntegrationTest::assertType() has been deprecated, as part of the work to move to PHPUnit 8; PHPUnit's assertInternalType() was deprecated, and will be removed in PHPUnit 9. MediaWikiIntegrationTest::assertTypeOrValue(), a wrapper for assertType(), has been removed immediately, without deprecation.
  • AbstractBlock::getReason is deprecated, since reasons are actually stored as CommentStoreComments, and getReason returns a string with no caller control over language or formatting. Instead use AbstractBlock::getReasonComment, which returns the CommentStoreComment.
  • The global function wfGetRusage() is deprecated and will now always call the getrusage() function without checking for its existence.
  • The properties User::mBlock, User::mBlockedby and User::mHideName are deprecated. Instead, use User::getBlock to get the block, then use AbstractBlock::getByName or AbstractBlock::getHideName.Use the GetUserBlock hook to set, unset or modify a block, including hiding or unhiding a user.
  • Directly calling the MergeHistory constructor is deprecated. Instead, use the new MergeHistoryFactory class.
  • Language::factory() and Language::getParentLanguage() are deprecated, and so is directly calling the Language constructor. Use the new LanguageFactory class instead.
  • Language::classFromCode() is deprecated. There is no reason it should be used outside the Language class itself.
  • Language::clearCaches() is deprecated. Instead, reset all services and set Language::$mLangObjCache = [].
  • The following functions from Language class are deprecated in favour of respective functions in LanguageConverter:
    • autoConvert
    • autoConvertToAllVariants
    • convert
    • convertTitle
    • convertNamespace
    • hasVariants
    • hasVariant
    • convertHtml
    • convertCategoryKey
    • getVariants
    • getPreferredVariant
    • getURLVariant
    • findVariantLink
    • getExtraHashOptions
    • updateConversionTable
  • Language::classFromCode() is hard deprecated and should be removed in 1.36
  • Language::getConverter() is deprecated and should be removed in 1.36
  • Language::MESSAGES_FALLBACKS, Language::STRICT_FALLBACKS were deprecated. Use LanguageFallback::MESSAGES and LanguageFallback::STRICT respectively
  • Language::$mLangObjCache is deprecated and should be removed in 1.36. Use MediaWikiServices instead to get a LanguageFactory.
  • Language::getMessagesFor(), getMessageFor(), and getMessageKeysFor() are deprecated. Use LocalisationCache's getItem(), getSubitem(), and getSubitemList() methods directly.
  • OutputPage::getCSPNonce() is deprecated, use OutputPage::getCSP()->getNonce() instead.
  • DerivedPageDataUpdater::prepareUpdate accepted as its second parameter an optional array of options. Specifying the value of the `oldrevision` key of the array to be a Revision object, rather than a RevisionRecord object, is hard deprecated. The same applies to the options parameter in WikiPage::doEditUpdates.
  • Skin::makeI18nUrl() and makeNSUrl() have been deprecated, no longer used.
  • Title::countAuthorsBetween and Title::getAuthorsBetween were hard deprecated. Use respective methods in RevisionStore instead.
  • Remove deprecated SkinCopyrightFooter &$forContent parameter
  • The following Language class static variables have been replaced with constants and deprecated: $mWeekdayMsgs, $mWeekdayAbbrevMsgs, $mMonthMsgs, $mMonthGenMsgs, $mMonthAbbrevMsgs, $mIranianCalendarMonthMsgs, $mHebrewCalendarMonthMsgs, $mHebrewCalendarMonthGenMsgs, $mHijriCalendarMonthMsgs and $durationIntervals.
  • As part of dropping security support for IE 6 and IE 7, WebRequest::checkUrlExtension() has been deprecated, and now always returns true.
  • The following ApiBase::PARAM_* constants have been deprecated in favor of equivalent ParamValidator constants: PARAM_DFLT, PARAM_ISMULTI, PARAM_TYPE, PARAM_MAX, PARAM_MAX2, PARAM_MIN, PARAM_ALLOW_DUPLICATES, PARAM_DEPRECATED, PARAM_REQUIRED, PARAM_SUBMODULE_MAP, PARAM_SUBMODULE_PARAM_PREFIX, PARAM_ALL, PARAM_EXTRA_NAMESPACES, PARAM_SENSITIVE, PARAM_DEPRECATED_VALUES, PARAM_ISMULTI_LIMIT1, PARAM_ISMULTI_LIMIT2, PARAM_MAX_BYTES, PARAM_MAX_CHARS.
  • ApiBase::explodeMultiValue() is deprecated. Use ParamValidator::explodeMultiValue() instead.
  • ApiBase::parseMultiValue() is deprecated. No replacement is provided; generally this sort of thing should be handled by fully validating the parameter.
  • ApiBase::validateLimit() and ApiBase::validateTimestamp() are deprecated. Use ApiParamValidator::validateValue() with an appropriate settings array instead.
  • ContentHandler (use ContentHandlerFactory):
    • getForTitle
    • getForContent
    • getForModelID
    • getContentModels
    • getAllContentFormats
    • protected $handler (not need anymore)
    • cleanupHandlersCache (not need anymore)
  • (task T212738) The $wgVersion global is deprecated; instead, use MW_VERSION.
  • $wgMemc is deprecated, use MediaWikiServices::getLocalServerObjectCache() instead.
  • ObjectCache::detectLocalServerCache() is deprecated, instead use MediaWikiServices::getLocalServerObjectCache() or ObjectCache::makeLocalServerCache().
  • ImagePage::getImageLimitsFromOptions() is deprecated. Use static function MediaFileTrait::getImageLimitsFromOptions() instead.
  • As part of work to replace the Parser, alongside the breaking changes listed above, a large number of deprecations changes been made, to simplify the API or because they will not be supported in replacement:
    • Parser::doBlockLevels() (and BlockLevelPass class has been marked @internal)
    • Parser::setFunctionTagHook()
    • Parser::attributeStripCallback()
    • Parser::fetchTemplate() - use Parser::fetchTemplateAndTitle() instead.
    • Parser::enableOOUI() - use $parser->getOutput()->enableOOUI() instead.
    • LinkHolderArray has been deprecated for public usage and will be internal part of parser.
    • The following parser-related hooks have been deprecated:
    • The accessor/mutator methods Parser::Options(), Parser::OutputType(), and Parser::Title() have been deprecated; use the appropriate Parser::get* or Parser::set* methods instead.
    • Parser::firstCallInit() has been deprecated. The parser is initialized fully on construction and so ::firstCallInit() no longer has any effect when manually invoked.
    • ParserOptions::setAllowExternalImages(), ::setAllowExternalImagesFrom(), and ::setEnableImageWhitelist() have been deprecated. Future parsers will not allow per-parser configuration of image filtering; use site configuration instead.
    • ParserOptions::getTidy() and ParserOptions::setTidy() have been deprecated. These options no longer have any effect.
    • Most methods of MWTidy, except for MWTidy::tidy(), have been deprecated; tidiness is always enabled and not configurable.
    • Version 1 of the parserTests file format has been deprecated. You'll need to update your parser tests to version 2, which uses Remex tidy on all test output by default. Support for parser tests with Remex tidy off will later be removed entirely.
    • $wgParser — This global variable, soft deprecated in 1.32, has now been hard deprecated. Use MediaWikiServices::getInstance()->getParser() instead. (task T160811)
  • The signature of DefaultPreferencesFactory::__construct has been changed:
    LanguageConverter $languageConverter has been added.
    and its usage with old arguments is hard deprecated.
  • The public usage of the following properties of LanguageConverter have beendeprecated as there is no reason they should be used outside the LanguageConverter class and will be changed from public to private:
    • mLangObj
    • mUcfirst
    • mConvRuleTitle
    • mURLVariant
    • mUserVariant
    • mHeaderVariant
    • mMaxDepth
    • mVarSeparatorPattern
    changed from public to protected:
    • mTables
  • The ArticleEditUpdatesDeleteFromRecentchanges hook has been deprecated. Please use the RecentChange_save hook or similar instead.
  • The ArticleEditUpdates hook has been deprecated. Please use the RevisionDataUpdates hook or similar instead.
  • The SkinTemplatePreventOtherActiveTabs and SkinTemplateTabAction hooks have been hard deprecated. Please use the SkinTemplateNavigation__Universal hook instead.
  • ResourceLoaderFileModule::compileLessFile() has been deprecated, use ResourceLoaderFileModule::compileLessString() instead
  • The SquidPurgeClient and SquidPurgeClientPool classes have been deprecated. Use MultiHttpClient or HtmlCacheUpdater instead.
  • MimeAnalyzer::getExtensionsForType() and ::getTypesForExtensions() were deprecated in favor of MimeAnalyzer::getExtensionsFromMimeType() and ::getMimeTypesFromExtension(), respectively. The new methods return arrays rather than strings.
  • Calling Action::factory and Action constructor with WikiPage has been hard deprecated. Caller must provide an Article instance.
  • ApiTestCase::doLogin, soft deprecated in 1.31, was hard deprecated.
  • WebRequest::getLimitOffset is hard deprecated. Instead, use ::getLimitOffsetForUser and pass a User object.
  • PageArchive::getPreviousRevision is hard deprecated. Instead, use the new::getPreviousRevisionRecord method.
  • PageArchive::getArchivedRevision is hard deprecated. Instead, use the new ::getArchivedRevisionRecord method.
  • PageArchive::undelete is hard deprecated. Instead, use ::undeleteAsUser and pass a User object.
  • PageArchive::getRevision is hard deprecated.
  • EditPage::getBaseRevision was hard deprecated. Instead, use the new ::getExpectedParentRevision method.
  • The public variable EditPage::$mBaseRevision was hard deprecated.
  • FileDeleteForm previously did not accept a user parameter in its constructor, instead relying on the global $wgUser . A user parameter has been added, and //not// providing a user is deprecated. There are no known callers outside of mediawiki core.
  • AuthManager::singleton() has been deprecated. Use MediaWikiServices::getInstance()->getAuthManager() instead.
  • ContribsPager::tryToCreateValidRevision is hard deprecated. Instead, use ContribsPager::tryCreatingRevisionRecord.
  • The following functions all accept an optional user parameter. Not passing a user is hard deprecated, and support for calling them without passing a user will be removed in 1.36:
    • Title::getNotificationTimestamp (note however that the method is deprecated in its entirely in favor of the new WatchlistNotificationManager service)
    • PatrolLog::record
    • LogEventsList::userCan
    • LogEventsList::userCanBitfield
    • LogEventsList::userCanViewLogType
    • LogPage::addEntry
    • FileDeleteForm::doDelete
    • OldLocalFile::userCan
    • ArchivedFile::userCan
    • File::userCan
  • The following functions all accept an optional audience parameter and an optional user parameter. If the audience is FOR_THIS_USER and no user is passed, they fallback to $wgUser . Not passing a user when one is needed is deprecated
    • LogEventsList::getExcludeClause
    • WikiPage::getComment
    • WikiPage::getCreator
    • WikiPage::getUser
    • WikiPage::getUserText
  • UploadBase::checkWarnings now accepts a User parameter; not providing a user is soft deprecated.
  • Article::insertProtectNullRevision and WikiPage::insertProtectNullRevision were hard deprecated. Instead, use WikiPage::insertNullProtectionRevision.
  • Article::doDeleteArticle, Article::doDeleteArticleReal, and WikiPage::doDeleteArticle are all deprecated. Instead, use WikiPage::doDeleteArticleReal.
  • Article::getComment is deprecated. Instead, use WikiPage::getComment.
  • Article::getCreator is deprecated. Instead, use WikiPage::getCreator.
  • Article::updateRevisionOn() and ::updateIfNewerOn(), and WikiPage::updateIfNewerOn() are deprecated. Instead, use WikiPage::updateRevisionOn().
  • Article::getUser is deprecated. Instead, use WikiPage::getUser.
  • Article::getUserText is deprecated. Instead, use WikiPage::getUserText.
  • Article::prepareContentForEdit is hard deprecated. Instead, use WikiPage::prepareContentForEdit.
  • WikiPage::prepareContentForEdit previously accepted either a Revision or a RevisionRecord object as its optional second parameter. Passing a Revision is now hard deprecated.
  • Article::getUndoContent and WikiPage::getUndoContent are hard deprecated. Instead, use ContentHandler::getUndoContent.
  • Passing Revision objects to ContentHandler::getUndoContent is hard deprecated. Instead, pass the associated Content objects, as well as whether the undo is from the current revision.
  • Article::doDeleteUpdates and ::doEditUpdates are deprecated. Instead, use WikiPage::doDeleteUpdates and ::doEditUpdates.
  • WikiPage::doEditUpdates previously accepted a Revision object as its first parameter. It now accepts RevisionRecord objects, and passing Revision objects is deprecated.
  • Article::getRevisionFetched is deprecated. Instead, use the fetchRevisionRecord method, which has been converted from protected to public.
  • LocalFileDeleteBatch was migrated to a new constructor signature with the user as the second parameter. Support for the old signature is hard deprecated, and once removed the user parameter will be required. At the same time, a number of file-deletion related methods were updated
    • File::delete is hard deprecated in favor of the new ::deleteFile
    • LocalFile::delete is hard deprecated in favor of the new ::deleteFile
    • LocalFile::deleteOld is hard deprecated in favor of the new ::deleteOldFile
    • ForeignDBFile::delete is hard deprecated in favor of the new ::deleteFile
  • File::recordUpload (along with the respective methods in the LocalFile and ForeignDBFile classes) is hard deprecated, and LocalFile::recordUpload2 is soft deprecated. Use the new LocalFile::recordUpload3, which has a different signature and requires that a User parameter is passed.
  • The SpecialPageFactory class was moved from the MediaWiki\Special namespace to the MediaWiki\SpecialPage namespace. The old location remains as a deprecated alias.
  • Title::userCan, ::quickUserCan, and ::getUserPermissionsErrors, which were deprecated in 1.33, were hard deprecated. Instead, use PermissionManager::userCan, ::quickUserCan, and ::getPermissionErrors.
  • All methods of the old SpecialPageFactory, deprecated in 1.32, were hard deprecated. Instead, get a SpecialPageFactory from MediaWikiServices and use its methods.
  • User::updateNewtalk now accepts as its optional third parameter a RevisionRecord object; passing a Revision is hard deprecated.
  • User::getNewMessageRevisionId and ::getNewMessageLinks were hard deprecated.
  • DifferenceEngine::getRevisionHeader now accepts a RevisionRecord as its first parameter; passing a Revision is hard deprecated.
  • WikiPage::doDeleteUpdates now accepts as its optional third parameter a RevisionRecord object; passing a Revision is hard deprecated.
  • WikiPage::onArticleEdit now accepts as its optional second parameter a RevisionRecord object; passing a Revision is hard deprecated.
  • Global $wgUser variable was soft deprecated.
  • The Revision class was soft deprecated entirely in 1.31. All methods have now been individually hard deprecated:
    • ::__construct - create MutableRevisionRecord objects instead
    • ::newFromId - use RevisionLookup::getRevisionById instead
    • ::newFromTitle - use RevisionLookup::getRevisionByTitle instead
    • ::newFromPageId - use RevisionStore::getRevisionByPageId instead
    • ::newFromArchiveRow - use RevisionFactory::newRevisionFromArchiveRow
    • ::newFromRow - use RevisionStore::newRevisionFromRow instead
    • ::loadFromPageId - use RevisionStore::getRevisionByPageId instead
    • ::loadFromTitle - use RevisionStore::getRevisionByTitle instead
    • ::loadFromTimestamp - use RevisionStore::getRevisionByTimestamp instead
    • ::getQueryInfo - use RevisionStore::getQueryInfo instead
    • ::getArchiveQueryInfo - use RevisionStore::getArchiveQueryInfo instead
    • ::getParentLengths - use RevisionStore::getRevisionSizes instead
    • ::getRevisionRecord - no replacement
    • ::getId - use RevisionRecord::getId instead
    • ::setId - use MutableRevisionRecord::setId instead
    • ::setUserIdAndName - use MutableRevisionRecord::setUser instead
    • ::getTextId - use SlotRecord::getContentAddress for retrieving an actual content address, or RevisionRecord::hasSameContent to compare content
    • ::getParentId - use RevisionRecord::getParentId instead
    • ::getSize - use RevisionRecord::getSize instead
    • ::getSha1 - use RevisionRecord::getSha1 instead
    • ::getTitle - use RevisionRecord::getPageAsLinkTarget instead
    • ::setTitle - the method was previously a no-op
    • ::getPage - use RevisionRecord::getPageId instead
    • ::getUser - use RevisionRecord::getUser and then User::getId instead
    • ::getUserText - use RevisionRecord::getUser and then User::getName instead
    • ::getComment - use RevisionRecord::getComment instead
    • ::isMinor - use RevisionRecord::isMinor instead
    • ::isUnpatrolled - use RevisionStore::getRcIdIfUnpatrolled instead
    • ::getRecentChange - use RevisionStore::getRecentChange instead
    • ::isDeleted - use RevisionRecord::isDeleted instead
    • ::getVisibility - use RevisionRecord::getVisibility instead
    • ::getContent - use RevisionRecord::getContent instead
    • ::getSerializedData - use SlotRecord::getContent for retrieving a content object, and Content::serialize for the serialized form
    • ::getContentModel - use SlotRecord::getModel instead
    • ::getContentFormat - use SlotRecord::getFormat instead, with a fallback to ContentHandler::getDefaultFormat
    • ::getContentHandler - use ContentHandlerFactory::getContentHandler instead
    • ::getTimestamp - use RevisionRecord::getTimestamp instead
    • ::isCurrent - use RevisionRecord::isCurrent instead
    • ::getPrevious - use RevisionLookup::getPreviousRevision instead
    • ::getNext - use RevisionLookup::getNextRevision instead
    • ::getRevisionText - use RevisionRecord::getContent instead
    • ::compressRevisionText - use SqlBlobStore::compressData instead
    • ::decompressRevisionText - use SqlBlobStore::decompressData instead
    • ::insertOn - use RevisionStore::insertRevisionOn instead
    • ::base36Sha1 - use SlotRecord::base36Sha1 instead
    • ::newNullRevision - use RevisionStore::newNullRevision
    • ::userCan - use RevisionRecord::userCanBitfield instead
    • ::userCanBitfield - use RevisionRecord::userCanBitfield instead
    • ::getTimestampFromId - use RevisionStore::getTimestampFromId instead
    • ::countByPageId - use RevisionStore::countRevisionsByPageId instead
    • ::countByTitle - use RevisionStore::countRevisionsByTitle instead
    • ::userWasLastToEdit - use RevisionStore::userWasLastToEdit instead
    • ::newKnownCurrent - use RevisionStore::getKnownCurrentRevision instead
  • The Revision method had a few methods that were previously protected and have been made private. They were:
    • ::getRevisionStore
    • ::getRevisionLookup
    • ::getRevisionFactory
    • ::getBlobStore
    The $mRecord variable was also changed from protected to private.
  • Multiple hooks that include Revision objects were deprecated. The hooks, as well as suitable replacements, are noted below:
  • The following RevisionStore methods were deprecated:
    • ::loadRevisionFromTitle
    • ::loadRevisionFromTimestamp
    • ::loadRevisionFromPageId
    • ::listRevisionSizes
  • WikiPage::$mLastRevision was changed from protected to private.
  • RecentChange::markPatrolled was deprecated. Use ::doMarkPatrolled instead.
  • The JobRunner class has been converted to a service class. Direct construction is deprecated, use MediaWikiServices::getJobRunner.
  • JobRunner::setLogger has been deprecated, thus using JobRunner as a LoggerAwareInterface is deprecated as well. Rely on the logger passed in the constructor instead.
  • LogEventsList::typeAction accepts an optional right to check against as the fourth parameter. Specifying such a right is deprecated.
  • SkinTemplate::makeArticleUrlDetails has been deprecated, no longer used.
  • Passing a Revision object into CategoryMembershipChange constructor is deprecated. Pass a RevisionRecord instead.
  • The "mediawiki.legacy.oldshared" module has been deprecated. Skins and extensions that are using this should copy its necessary CSS rules to their own styles module. CologneBlue and Nostalgia skins serve as examples.
  • The "mediawiki.legacy.shared" module has been deprecated. Use the "mediawiki.skinning.*" modules, or ResourceLoaderSkinModule instead.
  • The following hooks, soft deprecated in 1.24, have been hard deprecated:
  • Calling Action::factory and Action constructor with any Page implementations other than Article is deprecated.
  • Action::page property is deprecated for direct access. Use Action::getArticle or Action::getWikiPage instead.
  • LESS `.background-image-svg()` mixin from 'mediawiki.mixins.less' is deprecated and should be removed in 1.36.
  • LESS `.background-image-svg-quick()` mixin from 'mediawiki.mixins.less' is deprecated and should be removed in 1.36.
  • The following methods were deprecated:
    • Title::getFirstRevision (hard deprecated)
    • Title::getEarliestRevTime
    • WikiPage::getOldestRevision (hard deprecated)
    • Article::getOldestRevision (hard deprecated)
      Use RevisionStore::getFirstRevision instead.
  • WikiPage::commitRollback and ::doRollback are declared to be internal in preparation for breaking changes. Neither method has any known callers outside of MediaWiki core. Both methods modify an array passed by reference ($resultDetails) - accessing the Revision objects added to that array (using the keys `current` and `target`) is also deprecated.
  • The following Linker methods previously accepted Revision objects as parameters. They now accept either Revision or RevisionRecord objects. Passing a Revision object is hard deprecated.
    • ::revUserLink
    • ::revUserTools
    • ::revComment
    • ::generateRollback
    • ::getRollbackEditCount
    • ::buildRollbackLink
    • ::getRevDeleteLink
  • WikiPage::hasDifferencesOutsideMainSlot previously accepted Revision objects for its two parameters. It now accepts RevisionRecord objects, and passing Revision objects is hard deprecated.
  • WikiPage::updateRevisionOn previously accepted Revision objects for its second parameter. It now accepts RevisionRecord objects, and passing Revision objects is hard deprecated.
  • The ParserGetVariableValueVarCache hook has been deprecated.
  • When using the ParserGetVariableValueSwitch hook, the following unusual uses have been deprecated: modifying the passed $magicWordId or failing to cache the returned value in $variableCache. The related MagicWordwgVariableIDs hook has been deprecated and renamed; use the GetMagicVariableIDs hook instead.
  • The following Parser properties have been deprecated:
    • ::$mTagHooks
    • ::$mFunctionHooks
    • ::$mMarkerIndex
    • ::$mFirstCall
    • ::$mPreprocessor
    • ::$mOutput
    • ::$mStripState
    • ::$mLinkID
    • ::$mIncludeSizes
    • ::$mPPNodeCount
    • ::$mGeneratedPPNodeCount
    • ::$mHighestExpansionDepth
    • ::$mDoubleUnderscores
    • ::$mExpensiveFunctionCount
    • ::$mShowToc
    • ::$mUser
    • ::$mOptions
    • ::$mTitle
    • ::$ot
    • ::$mRevisionObject
    • ::$mRevisionId
    • ::$mRevisionTimestamp
    • ::$mRevisionUser
    • ::$mRevisionSize
    • ::$mInputSize
    • ::$mInParse
  • LinksUpdate::getRevision and ::setRevision are hard deprecated in favor of the new ::getRevisionRecord and ::setRevisionRecord methods.
  • A large number of exposed variables and methods of Article were deprecated as part of its planned removal:
    • Article::$mContext is deprecated; use getContext()/setContext() instead.
    • Article::__get(), ::__set() are hard deprecated, use the WikiPage properties instead.
    • These Article methods were hard deprecated; use their WikiPage equivalents:
      • ::checkFlags,
      • ::checkTouched,
      • ::clearPreparedEdit,
      • ::commitRollback,
      • ::doDeleteArticleReal,
      • ::doEditContent,
      • ::doPurge,
      • ::doRollback,
      • ::doUpdateRestrictions,
      • ::doViewUpdates,
      • ::exists,
      • ::followRedirect,
      • ::getContentHandler,
      • ::getContentModel,
      • ::getContributors,
      • ::getDeletionUpdates,
      • ::getHiddenCategories,
      • ::getId,
      • ::getLatest,
      • ::getLinksTimestamp,
      • ::getMinorEdit,
      • ::getRedirectTarget,
      • ::getRedirectURL,
      • ::getTimestamp,
      • ::getTouched,
      • ::hasViewableContent,
      • ::insertOn,
      • ::insertRedirect,
      • ::insertRedirectEntry,
      • ::isCountable,
      • ::isRedirect,
      • ::loadFromRow,
      • ::loadPageData,
      • ::lockAndGetLatest,
      • ::makeParserOptions,
      • ::pageDataFromId,
      • ::pageDataFromTitle,
      • ::prepareContentForEdit,
      • ::protectDescription,
      • ::protectDescriptionLog,
      • ::replaceSectionAtRev,
      • ::setTimestamp,
      • ::shouldCheckParserCache,
      • ::supportsSections,
      • ::triggerOpportunisticLinksUpdate,
      • ::updateCategoryCounts, and
      • ::updateRedirectOn.
    • Article::generateReason() was hard deprecated; instead, please use WikiPage::getAutoDeleteReason().
    • Article::replaceSectionContent() was hard deprecated, use Article::replaceSectionAtRev() instead.
    • Article::getRevision and WikiPage::getRevision were hard deprecated in favor of the new WikiPage::getRevisionRecord method.
  • A new UserNameUtils service was introduced. The following User methodswere deprecated in favor of using the new service:
    • isIP
    • isIPRange
    • isValidUserName
    • isUsableName
    • isCreatableName
    • getCanonicalName
  • The signature of WikiPage::doDeleteArticleReal was changed to make the user the second parameter, and the suppression option the third parameter. Previously, the third parameter was unused. Using the old signature is hard deprecated.
  • ApiQueryRevisions::getRollbackToken, which has been soft deprecated since 1.24, accepted as its third parameter a Revision object. It now accepts a RevisionRecord, and passing a Revision is hard deprecated.
  • Passing Article to ParserCache::get() was deprecated
  • ParserOptions::newCanonical() with no first parameter, or null as the first parameter, which falls back to using global $wgUser , is hard deprecated.
  • Parser::fetchCurrentRevisionOfTitle, ::statelessFetchRevision, and ::getRevisionObject were hard deprecated in favor of the new ::fetchCurrentRevisionRecordOfTitle, ::statelessFetchRevisionRecord, and ::getRevisionRecordObject methods respectively.
  • ParserOptions::getCurrentRevisionCallback and ::setCurrentRevisionCallback were hard deprecated in favor of the new ::getCurrentRevisionRecordCallback and ::setCurrentRevisionRecordCallback methods respectively.
  • Parser::statelessFetchTemplate returns an array; accessing the Revision object returned (via the `revision` key to the array) is deprecated. Instead, use `revision-record` to retrieve the equivalent RevisionRecord.
  • WikiPage::doEditContent returns an array, and PageUpdater::getStatus returns a Status object with an array value. For both of those arrays, accessing the Revision object returned (via the `revision` key to the array) is deprecated. Instead, use `revision-record` to retrieve the equivalent RevisionRecord.
  • Page interface was deprecated. Use Article or WikiPage instead.
  • The following DatabaseBlock methods are deprecated because they are no longer needed in core: chooseBlock, fromMaster, deleteIfExpired.
  • wfGetScriptUrl() was deprecated. The script URL should be configured rather than detected. wfScript() can be used to get a configured script URL.
  • Action::factory() with null $action argument is hard deprecated
  • The following methods of the User class were deprecated: getDefaultOptions, getDefaultOption, getOptions, getOption, getBoolOption, getIntOption, setOption, listOptionKinds, getOptionKinds, resetOptions. Use corresponding methods in UserOptionsLookup or UserOptionsManager service classes instead.
  • UserRetrieveNewTalks hook was deprecated without replacement.
  • User::getNewtalk and ::setNewtalk were hard deprecated. Use service TalkPageNotificationManager instead.
  • EditPage::matchSpamRegex and ::matchSummarySpamRegex were hard deprecated in favor of the new SpamChecker service.
  • Title::getNotificationTimestamp, User::clearNotification, and User::clearAllNotifications were deprecated in favor of the new WatchlistNotificationManager service.
  • SpecialPage::setListed() and SpecialPage::listed() were deprecated. Subclass UnlistedSpecialPage to set listed as false, and use SpecialPage::isListed() to get the value.
  • CategoryPage::getCategoryViewerClass() and ::setCategoryViewerClass() were deprecated.
  • MWHttpRequest and its subclasses PhpHttpRequest, CurlHttpRequest and GuzzleHttpRequest now require the timeout and connectTimeout options to always be specified, otherwise a deprecation warning will be raised. Most callers should use HttpRequestFactory which always sets these options.
  • Linker::normaliseSpecialPage() has been deprecated, instead make use of LinkRenderer::normalizeTarget().
  • SkinTemplate::getPersonalToolsList() was soft deprecated.
  • ChangeTags::truncateTagDescription() has been deprecated.
  • The following methods of the User class are deprecated: getGroups, getGroupMemberships, getEffectiveGroups, getAutomaticGroups, addGroup, removeGroup, getFormerGroups, getAllGroups, getImplicitGroups, addAutopromoteOnceGroups. Use the new UserGroupManager service instead.
  • The following methods of the UserGroupMembership class were deprecated: selectFields, getMembershipsForUser, getMembership, insert, delete, newFromRow, initFromRow, purgeExpired. Use the new UserGroupManager service instead.
  • wfWaitForSlaves() has been hard deprecated. Use LBFactory::waitForReplication instead. It was soft deprecated in 1.27.
  • BaseTemplate::getAfterPortlet and ::renderAfterPortlet have been deprecated in favor of the Skin::getAfterPortlet method. Skin::getAfterPortlet does not wrap the result in a div, callers are responsible for that. The hook BaseTemplateAfterPortlet , called by both methods has been deprecated as well and is replaced by SkinAfterPortlet.
  • Autopromote class has been soft deprecated and it's methods moved into UserGroupManager.
  • SkinTemplateBuildNavUrlsNav_urlsAfterPermalink hook has been deprecated. Use SidebarBeforeOutput hook and get the revision id from the OutputPage object.
  • BaseTemplate::getToolbox() method has been soft deprecated. The toolbox data is now available in a sidebar data array which you can get from any class that's extending QuickTemplate class. The hook associated with this method, BaseTemplateToolbox, has been hard deprecated. To add items to the toolbox, use SidebarBeforeOutput hook instead.
  • The SkinTemplateOutputPageBeforeExec hook is deprecated. The page mw:Manual:Hooks/SkinTemplateOutputPageBeforeExec and task T60137 for recommendations for alternative approaches based on how developers previously used this hook.
  • SkinTemplateToolboxEnd hook has been deprecated. Use SidebarBeforeOutput hook instead.
  • Using Skin::addToBodyAttributes() method to add body attributes has been deprecated. Use OutputPageBodyAttributes hook instead.
  • Installer::getDBTypes has been hard deprecated in favor of InstallerDBSupport::getDatabases
  • The hooks BeforeHttpsRedirect , CanIPUseHTTPS and UserRequiresHTTPS were deprecated, as part of a long-term plan to remove support for mixed HTTP/HTTPS wikis.
  • Skin::generateDebugHTML() has been hard deprecated. Call MWDebug::getHTMLDebugLog() directly.
  • ExternalStoreDB::getSlave(), soft deprecated in 1.34, was hard deprecated. Use ExternalStoreDB::getReplica() instead.
  • Less variables in mediawiki.ui/variables.less file that don't follow the standard variable naming scheme (compare WikimediaUI Base) including `@colorGray* variables have been deprecated. New variables are in place and aliases have been set. Replace occurrences and use the new variables instead.

Other changes in 1.35 edit

  • A new maintenance script is added (purgeExpiredWatchlistItems.php) with which to delete expired watchlist items. These items will also be deleted during wiki editing if $wgWatchlistPurgeRate is > 0. This maintenance script only has effect if $wgWatchlistExpiry is true. It is recommended that a cronjob or similar be set up to run it at least daily.
  • Title::purgeSquid is deprecated. Use MediaWikiServices::getHtmlCacheUpdater.
  • SpecialVersion::getExtLicenseFileName() has been deprecated, use MediaWiki\ExtensionInfo::getLicenseFileNames() instead.
  • SpecialVersion::getExtAuthorsFileName() has been deprecated, use MediaWiki\ExtensionInfo::getAuthorsFileName() instead.
  • Migration to the new content storage schema is complete, all backwards compatibility code and duplication in the database have been removed. The old schema was a 1:1 relationship modeled by revision.text_id -> text.old_id. The new schema is a n:m relationship, revision.rev_id <- slots.slot_revision_id|slots.slot_content_id -> content.content_id|content.content_address -> text.old_id. The same applies to the archive table.
    • The following fields were removed:
      • revision.rev_text_id, replaced by content.content_address
      • revision.rev_content_model, replaced by content.content_model, referencing content_models.model_id
      • revision.rev_content_format, replaced by automatic detecting in ContentHandler
      • archive.ar_text_id, replaced by content.content_address
      • archive.ar_content_model, replaced by content.content_model, referencing content_models.model_id
      • archive.ar_content_format, replaced by automatic detecting in ContentHandler
  • Migration to normalized storage of edit comments and user names is progressing. The following fields were unused and have been removed:
    • revision.rev_comment, replaced by rev_comment_id referencing comment.comment_id.
    • revision.rev_user and rev_user_text, replaced by rev_actor referencing actor.actor_id.
    Note that archive.ar_user, archive.ar_user_text, and archive.ar_comment had already been removed in previous releases.
  • The printableversion has been marked as deprecated per task T167956.
  • (task T30162, task T245387) The installer supports using a Postgres server running on a custom port other than 5432.

Compatibility edit

MediaWiki 1.35 requires PHP 7.3.19 or later, and the following PHP extensions:

  • ctype
  • dom
  • fileinfo
  • iconv
  • json
  • mbstring
  • xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used, but support for them is somewhat less mature.

The supported versions are:

  • MySQL 5.5.8 or later
  • PostgreSQL 9.2 or later
  • SQLite 3.8.0 or later

Online documentation edit

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain): https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list edit

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help edit

There's usually someone online in the IRC channel #mediawiki connect.

MediaWiki 1.36 edit

MediaWiki 1.36.4 edit

This is a security and maintenance release of the MediaWiki 1.36 branch.

Changes since MediaWiki 1.36.3 edit

  • (task T298261) Fix support for Composer 2.2.
  • (task T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
  • Update doctrine/dbal (3.0.0 => 3.1.5).
  • (task T296898) Add entry point name to disabled Session exception if possible.
  • (task T298564) MemcachedClient: Add support for IPv6.
  • (task T297543, CVE-2022-28202) SECURITY: properly escape output used within galleries and Special:RevisionDelete.
  • (task T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
  • (task T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
  • Fix the json schema and the extension processor for Parsoid extension modules.
  • (task T299696) update.php: Avoid passing null to substr.
  • In PHP 8.1 don't throw exceptions from mysqli.
  • (task T289926) SiteConfiguration: Don't pass null to str_replace().
  • (task T264735) Fix deprecation warning from CURLPIPE_HTTP1.
  • (task T260735) Stop using is_resource() where possible.
  • (task T289879) Apply ReturnTypeWillChange to various implementations of built in interfaces.
  • (task T299312) Implement __serialize/__unserialize for PHP 8.1 support.
  • ExtensionRegistry: Add process cache for lazy attributes.
  • (task T301041) ApiPageSet: Add "missing": true to missing revisions.
  • Allow ParsoidModules extension schema to register services.
  • (task T297708) Allow setting max execution time to several special pages.
  • (task T302540) composer.json: Add ext-calendar to require.
  • (task T302540) composer.json: Add ext-simplexml to require-dev.
  • (task T302540) composer.json: Add various PHP extensions to suggests.
  • Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
  • (task T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
  • (task T293576) listFiles: Display file name instead of version.
  • (task T303871) Fix @since of Title::getId().
  • (task T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
  • wrapOldPasswords: add \n to two output calls.
  • (task T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion loop if it points to a local interwiki.
  • (task T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file uploads with actor as a condition can result in a DoS.

MediaWiki 1.36.3 edit

This is a security and maintenance release of the MediaWiki 1.36 branch.

Changes since MediaWiki 1.36.2 edit

  • (task T280363) mediawiki.page.ready: Introduce wikipage.indicators hook.
  • (task T290697) Add symfony/polyfill-php80.
  • IcuCollation: Add some more icu to unicode version mappings.
  • ApiBase: Annotate deprecated constants individually.
  • PHPVersionCheck: Mark PHP 7.4.0 - 7.4.2 as buggy.
  • (task T293044) installer: Fix 5th param to sourceFile() in DatabaseUpdater.
  • (task T291127) Always encode spaces in cookie values as "%20".
  • Use LocalFile::getHookRunner instead of LocalFile::hookRunner.
  • (task T293564) mediawiki.page.ready: Fire hook 'wikipage.indicators' with children.
  • HistoryBlobStub: add getLocation() to get $mOldId.
  • Fix checkStorage.php.
  • checkStorage: pass no parameters to WikiRevision::getContent().
  • (task T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion results.
  • (task T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
  • (task T294796) JobQueueRedis: Replace deprecated zSize with zCard.
  • (task T278037) NoLocalSettings: Pass an EmptyBagOStuff to TemplateParser.
  • (task T212428, task T267468) Allow populateContentTables to continue when there are bad blobs.
  • (task T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is set.
  • Update pear/mail_mime to 1.10.11.
  • Update deprecated Guzzle Psr7 function calls.
  • (task T281972) Follow-Up: I10fbd4b6a: Update @since tags as those were backported.
  • Tweak error message for missing composer dependencies.
  • (task T296112) Allow inserting new sections named '0'.
  • nukeNS: don't run purgeRedundantText() after every change.
  • (task T286779, task T297031) installer: Fix Postgres mistakes in using changeField method.
  • (task T225888) RollbackAction: fix missing pagetitle.
  • (task T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in undo actions.
  • (task T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
  • (task T34716, task T297416) SECURITY: Require 'read' right for most actions.
  • (task T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook when changing content model.

MediaWiki 1.36.2 edit

This is a security and maintenance release of the MediaWiki 1.36 branch.

Changes since MediaWiki 1.36.1 edit

  • Don't access MWServices prematurely in Maintenence.php.
  • (task T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
  • Installer: Fix foundation.wikimedia.org link in config-pingback-help.
  • (task T283273) Make postgres IRC channel point to libera.chat.
  • composer.json: Promote and pin monolog/monolog to require from require-dev.
  • (task T287526) JavaScriptMinifer: Recognize `...` as a single token.
  • (task T287526) Update wikimedia/minify to 2.2.4.
  • (task T289108) ExtensionProcessor: Remove loaderScripts from extension.json schemas.
  • (task T281549) Installer: Fix mediawiki-announce auto subscription code.
  • FormatJson: Optimize encode() for supported PHP versions.
  • (task T290398) renameRestrictions.php: Update protected_titles as well.
  • (task T290489) objectcache: Fix PHP warning for ReplicatedBagOStuff::setMulti.
  • $wgMimeTypeBlacklist - This configuration array now prohibits the
Request for comment (RFC)
Releases
Component General
Creation date {{{created}}}
Author(s) {{{author}}}
Document status

form of JavaScript, 'application/javascript', as well as previous MIME types.

  • (task T51097, task T290273) resourceloader: Call getStyleFiles from FileModule::getFileHashes.
  • (task T277788) parser: Avoid calling ParserOptions::getOption() too many times.
  • (task T291244) Unserialize objects in ParserCache->mExtensionData as objects.
  • MysqlUpdater: Add updatelog entries for dropDefault.
  • (task T290776) Fix $phase check in OutputHandler.
  • The wikimedia/parsoid library has been upgraded from v0.13.0 to v0.13.1.
  • (task T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
  • (task T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full table scan.
  • (task T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of Special:Contributions.

MediaWiki 1.36.1 edit

This is a security and maintenance release of the MediaWiki 1.36 branch.

Changes since MediaWiki 1.36.0 edit

  • (task T283942) DatabaseInstaller.php: Only run core schema file if specified table doesn't already exist.
  • (task T247223) Optimise MessageCache::isMainCacheable() for the single-message case.
  • (task T283244) JavaScriptMinifer: Fix handling of "delete" as object property.
  • (task T284391) Fix SkinModule to correctly prepend remote path on document root installs.
  • (task T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
  • (task T278579) Don't send headers on ob_end_clean().
  • (task T285287) MultiHttpClient: Replace PHP version check with defined().
  • (task T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging pages.

MediaWiki 1.36.0 edit

Changes since MediaWiki 1.36.0-rc.0 edit

  • (task T248481) rdbms: Use server time in DatabaseMysqlBase::getLagFromPtHeartbeat().
  • (task T281549) WebInstaller: Don't show the announce-l subscribe checkbox for now.
  • (task T264214) Follow-ups for UserGroupManager.
  • (task T282280) resourceloader: Fix path-only URLs in wiki modules when script path is docroot.
  • (task T281972) UserIdentityValue: Introduce convenience static factory methods.
  • (task T230428) Make page_is_redirect and page_is_new unsigned.
  • (task T280292) Legacy feature should not load thumbnail style rules (only layout).
  • (task T283247) Freenode -> Libera per wikimedia moving from freenode to libera.
  • (task T280270) composer: Lock Parsoid version to specific 0.13.0 release.
  • (task T142663) Add extension.json merge strategy "provide_default".
  • (task T283540) HookContainer: Fix normalization of callback for static handler.
  • (task T283464) registration: Fix array order for array_replace_recursive merge strategy.
  • (task T283539) Interwiki: Fix calling "onInterwikiLoadPrefix" hook.
  • (task T282594) Timeless: Re-branch to 40eb3dad1for REL1_36.

MediaWiki 1.36.0-rc.0 edit

Upgrading notes for 1.36 edit

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.36 upgrades are below:

  • MediaWiki 1.36 now requires the PHP internationalization extension (commonly referred to as Intl, ext-intl, or php-intl).
  • MediaWiki:Autoblock_whitelist has been moved to MediaWiki:Block-autoblock-exemptionlist. If you use this feature, please move the MediaWiki:Autoblock_whitelist page.
  • (task T275334) $wgExtensionFunctions is sometimes used to change configuration settings. This is not safe; extension functions are run relatively late, some services are already initialized by that point and so they use the old configuration. Changes in 1.36 make this kind of breakage even more common. You can use the MediaWikiServices hook instead. (In the future there might be a dedicated hook for configuration changes.)

For notes on 1.35.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.36 edit

MediaWiki update script, maintenance/update.php, used to accept `--nopurge` option to prevent clearing caches stored in the database during upgrade, this is no longer recommended and the option has been removed.

New configuration edit

  • (task T256001) $wgManualRevertSearchRadius – This setting introduces a feature that marks edits as reverts if they restore the page to an exact previous state. This configuration variable sets the maximum number of revisions of a page that will be checked against every new edit. Set this to 0 to disable the feature entirely.
  • (task T244058) $wgOldRevisionParserCacheExpireTime — This setting was added to control caching of ParserOutput for old revisions.
  • (task T265263) $wgRememberMe - This setting configures the "remember me" checkbox on account log-in systems via RememberMeAuthenticationRequest.
  • (task T157145) $wgSkinMetaTags – This setting allows configuration of skins to support meta tags. These tags make sharing of MediaWiki pages on a variety of social platforms more contentful and thus useful.
  • (task T280944) $wgIncludejQueryMigrate - This setting allows the jQuery Migrate plugin to be disabled. It has been enabled by default since MediaWiki 1.27.

Changed configuration edit

  • $wgLogos – The default value for the site logo, which is shown in an install if you have not set one, will now be the new logo of MediaWiki.
  • (task T274695) $wgAjaxEditStash — This setting, to disable the edit stashing feature when users start writing an edit summary, has been deprecated. In future releases, this feature will always be enabled.
  • $wgUploadStashScalerBaseUrl – This setting, to enable remote on-demand media scaling, was deprecated. Use the `thumbProxyUrl` setting in $wgLocalFileRepo instead.
  • $wgSlaveLagWarning and $wgSlaveLagCritical – These settings have been renamed, to $wgDatabaseReplicaLagWarning & $wgDatabaseReplicaLagCritical respectively. The former configuration variable names are deprecated, but will be used as the fall back if they are still set, and remain temporarily available for extensions which try to read them.
  • $wgWANObjectCaches - The "coalesceKeys" option was removed without deprecation. A new "coalesceScheme" option takes its place, and is "hash_stop" by default. If you use Dynomite, then set the new "coalesceKeys" option to "hash_tag".
  • $wgWANObjectCaches - The "cluster" and "mcrouterAware" options were removed without deprecation. Use "broadcastRoutingPrefix" instead.

Removed configuration edit

  • $wgUseTwoButtonsSearchForm — This setting, deprecated in 1.35, has been removed.
  • $wgAllowImageMoving — This setting, deprecated in 1.35, has been removed. Use group permission settings instead. For example, to prevent sysops from moving files, set `$wgGroupPermissions['sysop']['movefile'] = false;`
  • $wgExtNewTables, $wgExtNewFields, $wgExtNewIndexes, $wgExtPGNewFields, $wgExtPGAlteredFields, $wgExtModifiedFields — These settings were removed. They became obsolete after 1.17 overhauled the database updater, but were kept for backwards compatibility. The LoadExtensionSchemaUpdates hook should be used instead.
  • $wgParserConf - This setting, deprecated in 1.35, has been removed. The preprocessor configuration which used to live within this setting was deprecated in 1.34 and removed in 1.35.
  • $wgEnableRestAPI - This setting, ignored since 1.35, has been removed.
  • $wgPagePropsHaveSortkey – This temporary setting has been removed, along with the schema change upgrade path it controlled. If your site is still using it, meaning you have not yet applied the `pp_sortkey` schema change from 1.24, you must now apply it before upgrading.
  • The deprecated password policies PasswordCannotMatchBlacklist and PasswordNotInLargeBlacklist were removed. Please use PasswordCannotMatchDefaults and PasswordNotInCommonList instead.

New user-facing features in 1.36 edit

  • The logo of MediaWiki has changed. This means that the "Powered By MediaWiki" button shown in the skin footer will be different.
  • All HTML5 named entities are now accepted in wikitext.
  • (task T106263) The file description page's alternate sizes now include 2048px.

New developer features in 1.36 edit

  • Parser test files can now declare a dependency on a specific extension being loaded, not just on the presence of a certain extension tag hook. This is a better fit for extensions like TimedMediaHandler, which affect the output but don't register parser hooks. Use `extension:Foo` in the `!! hooks` section of your parser test file to declare a dependency on the `Foo` extension being loaded.
  • To expose code previously present in SpecialBlock/SpecialUnblock to other parts of the code, or to extensions, the new BlockUser and UnblockUser command objects were added. Use the BlockUserFactory and UnblockUserFactory services to create them.
  • The hook UsersPagerDoBatchLookupsHook takes now a \Wikimedia\Rdbms\IDatabase, instead of \Wikimedia\Rdbms\DBConnRef, as the first parameter.
  • MediaHandlers can now customize the formatting of the metadata they emit by over-riding MediaHandler::formatTag( $key, $value ). The default for unknown tags is numeric formatting; non-EXIF tags which are non-numeric should always use this method to specify the desired formatting.
  • The new 'title' type can be used to validate action API and REST API inputs.
  • The new ArticleParserOptions hook allows customizing the parser options used to parse wikitext for an article, based on user preferences, title, etc.
  • The new 'raw' type can be used to validate action API inputs. It bypasses the Unicode NFC normalization done on inputs of type 'string', so it more suitable when the input is binary or may contain deprecated Unicode sequences or characters (such as U+2001) that should be passed unmodified.
  • (task T260330) A new abstraction for running shell commands has been introduced, called BoxedCommand. A BoxedCommand object can be obtained with MediaWikiServices::getInstance()->getCommandFactory()->createBoxed().
  • ResourceLoader modules can now mark themselves as ES6-only by setting `'es6' => true` in their module definition. ES6-only modules will not be executed in browsers that don't support ES6, such as IE11.

External library changes in 1.36 edit

New external libraries edit

  • Added wikimedia/minify 2.2.1.
  • Added wikimedia/request-timeout 1.1.0.
  • Added wikimedia/shellbox 1.0.4.
  • Added WVUI 0.1.0.
  • Added symfony/symfony/polyfill-php80 1.23.1.

Changed external libraries edit

  • Updated composer/semver from 1.5.1 to 3.2.4.
  • Updated guzzlehttp/guzzle from 6.5.4 to 7.2.0.
  • Updated jQuery from v3.4.1 to v3.6.0.
  • Updated jQuery Migrate from v3.1.0 to v3.3.2.
  • Updated jquery.client from 2.0.2 to 3.0.0.
  • Updated OOUI from 0.39.3 to 0.41.3.
  • Updated pear/mail_mime from 1.10.8 to 1.10.9.
  • Updated pear/net_smtp from 1.9.1 to 1.9.2.
  • Updated pimple/pimple from 3.3.0 to 3.3.1.
  • Updated wikimedia/at-ease from 2.0.0 to 2.1.0.
  • Updated wikimedia/cldr-plural-rule-parser from 1.0.0 to 2.0.0.
  • Updated wikimedia/common-passwords from 0.2.0 to 0.3.0.
  • Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
  • Updated wikimedia/html-formatter from 1.0.2 to 3.0.1.
  • Updated wikimedia/ip-set from 2.1.0 to 3.0.0.
  • Updated wikimedia/ip-utils from 1.0.0 to 3.0.2.
  • Updated wikimedia/less.php from 3.0.0 to 3.1.0.
  • Updated wikimedia/object-factory from 2.1.0 to 3.0.0.
  • Updated wikimedia/php-session-serializer from 1.0.7 to 2.0.0.
  • Updated wikimedia/remex-html from 2.2.0 to 2.2.2.
  • Updated wikimedia/utfnormal from 2.0.0 to 3.0.2.
  • Updated wikimedia/wait-condition-loop from 1.0.1 to 2.0.1.
  • Updated wikimedia/xmp-reader from 0.7.0 to 0.8.1.
Changed development-only external libraries edit
  • Updated composer/spdx-licenses from 1.5.3 to 1.5.4.
  • Updated doctrine/dbal from 2.10.2 to 3.0.0.
  • Updated doctrine/sql-formatter from 1.1.0 to 1.1.1.
  • Updated mediawiki/mediawiki-phan-config from 0.10.2 to 0.10.6.
  • Updated monolog/monolog from 1.25.3 to 2.2.0.
  • Updated nikic/php-parser from 4.4.0 to 4.10.2.
  • Updated psy/psysh from 0.10.4 to 0.10.5.
  • Updated seld/jsonlint from 1.7.1 to 1.8.3.
  • Updated symfony/yaml from ~3.4|~4.3|~5.0.5 to ~3.4|~5.1.
  • Updated wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.

Removed external libraries edit

  • The html5shiv library has been removed, as support for Internet Explorer 8 has been dropped.
  • The wikimedia/avro suggested development-only library has been removed, as the support for logging in Avro format has been dropped.

Bug fixes in 1.36 edit

  • (task T190285) ApiEditPage module used to switch 'undo' and 'undoafter' parameters, if it founds you reversed them (based on assumption that higher revision ID indicates a later revision). The assumption is not always true, and is hindering proper edit undoing in some cases, hence the logic has been removed. Reversing the parameters will now lead to edit conflict or undefined behavior.
  • (task T263340) In history merging, pages with a content model that does not support redirects will now be recorded as deleted if no revision is being left in the source page (that's if all revisions of the page have been merged to another).

Action API changes in 1.36 edit

  • (task T269636) `Access-Control-Max-Age` was added to the default list of headers allowed for cross-origin API requests ($wgAllowedCorsHeaders).
  • (task T258108) Accounts with the 'bot' right no longer have pages automatically added to the watchlist when making API edits, regardless of their preferences. This is to reduce the size of the watchlist data in the database. To add API bot edits to the watchlist, explicitly set the 'watch' option.

Languages updated in 1.36 edit

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

  • (task T258975) Added a Latin/Cyrillic script converter for the Talysh language.
  • (task T245359) Split Bali script locale from "ban" (Balinese) (ban-bali).
  • (task T259330) Added language support for Mara (mrh).
  • (task T263968) Added language support for Nias (nia).
  • (task T264582) Added language support for Madurese (mad).
  • (task T270365) Added language support for Tyap (kcg).
  • (task T276745) Added language support for Wayuu (guc).

Breaking changes in 1.36 edit

  • Grade C (non-JavaScript) support for Internet Explorer 8 has been dropped.
  • (task T249459) wfIsBadImage(), deprecated in 1.34, has been removed.
  • (task T176526) EditPage::getContextTitle() will now throw an exception if a context title was not set using setContextTitle(). Previously, this mis-use would only cause a deprecation warning to be emitted.
  • The DeferredStringifier class, deprecated since 1.31, was removed.
  • Multiple methods that fell back to the $wgUser global variable were individually hard deprecated previously. The following have now been removed:
    • ApiTestCase::doLogin
    • Article::doDeleteArticle
    • Article::doDeleteArticleReal
    • Article::getComment
    • Article::getCreator
    • Article::getUser
    • Article::getUserText
    • Article::insertProtectNullRevision
    • File::delete
    • File::recordUpload
    • ForeignDBFile::delete
    • ForeignDBFile::recordUpload
    • LocalFile::delete
    • LocalFile::deleteOld
    • LocalFile::recordUpload
    • PageArchive::undelete
    • RecentChange::markPatrolled
    • Title::getUserPermissionsErrors
    • Title::quickUserCan
    • Title::userCan
    • WebRequest::getLimitOffset
    • WikiPage::doDeleteArticle
    • WikiPage::insertProtectNullRevision
  • The SpecialPageFactory class, deprecated in 1.32, has been removed. Use the SpecialPageFactory service instead.
  • Multiple methods previously had optional User parameters, with fallbacks to the $wgUser global variable. Not passing a User to those methods was previously hard deprecated, and support for not passing a User has now been removed:
    • ArchivedFile::userCan
    • File::userCan
    • FileDeleteForm::__construct
    • FileDeleteForm::doDelete
    • LocalFileDeleteBatch::__construct
    • LogEventsList::getExcludeClause (only needed for the 'user' audience)
    • LogEventsList::userCan
    • LogEventsList::userCanBitfield
    • LogEventsList::userCanViewLogType
    • LogPage::addEntry (also accepts user id instead)
    • OldLocalFile::userCan
    • PatrolLog::record
    • Title::getNotificationTimestamp (though the entire method is deprecated)
    • WikiPage::getComment (only needed for the FOR_THIS_USER audience)
    • WikiPage::getCreator (only needed for the FOR_THIS_USER audience)
    • WikiPage::getUser (only needed for the FOR_THIS_USER audience)
    • WikiPage::getUserText (only needed for the FOR_THIS_USER audience)
  • The following hooks have been removed:
    • APIQueryInfoTokens
    • APIQueryRecentChangesTokens
    • APIQueryRevisionsTokens
    • APIQueryUsersTokens
    • ApiTokensGetTokenTypes
  • LogEventsList::typeAction previously accepted an optional right parameter, and checked if the context user ($wgUser) had that right. Passing a right was hard deprecated in 1.35, and support for passing a right has now been removed.
  • WikiPage::doDeleteArticleReal previously accepted an optional user as its fifth parameter, and fell back to $wgUser if not user was provided. The signature changed to have the user as the second parameter, and the old signature was hard deprecated in 1.35. Support for the old signature has now been removed.
  • User::addNewUserLogEntry, deprecated since 1.27, was removed.
  • As part of refactoring the EditPage class, EditPage::setPreloadedContent, which had no known callers was removed entirely. Additionally, the following public methods were made private:
    • ::extractSectionTitle
    • ::getSummaryInputWidget
    • ::noSuchSectionPage
    • ::initialiseForm
  • EditPage::matchSpamRegex and ::matchSummarySpamRegex, deprecated in 1.35, were removed. Use the SpamChecker service instead.
  • The global function `wfWaitForSlaves`, deprecated in 1.27 and hard-deprecated in 1.35, has been removed. Use LBFactory::waitForReplication() instead.
  • Calling Action::factory() with null as the first parameter, rather than a string, was deprecated in 1.35 and support was now removed.
  • Calling Action::factory() with an object that wasn't an Article as the second parameter was deprecated in 1.35 and support was now removed.
  • The global variable $wgMemc, deprecated since 1.35, has been removed. Usage should generally be migrated to WANObjectCache, or if you really need the internal object, use ObjectCache::getLocalClusterInstance instead.
  • The preprocessDump.php maintenance script was removed.
  • CategoryFinder, which was deprecated in 1.31 and hard-deprecated in 1.35, has been removed.
  • GenderCache::singleton(), which was deprecated in 1.28 and hard-deprecated in 1.35, has been removed.
  • Sanitizer::escapeId(), deprecated in 1.30, has been removed.
  • Direct invocation of Parser::__construct() (instead of via a ParserFactory) now throws an exception; support has also been removed for several deprecated variants on the arguments passed to Parser::__construct. Direct invocation of Parser::__construct was deprecated in 1.34.
  • Parser::setFunctionTagHook(), deprecated in 1.35, has been removed.
  • The following properties of Parser, deprecated in 1.35, have been made private:
    • $mTagHooks - use Parser::getTags()
    • $mFunctionHooks - use Parser::getFunctionHooks()
    • $mOutput - use Parser::getOutput()
    • $mPreprocessor - use Parser::getPreprocessor()
  • The ParserBeforeTidy hook, deprecated in 1.35, has been removed.
  • The ParserBeforeTidy, ParserBeforeStrip, and ParserAfterStrip hooks, deprecated in 1.35, have been removed.
  • All methods of MWTidy except for MW::tidy() have been removed. These were each either marked as @internal or deprecated in 1.35.
  • (task T248062) Mixins `.background-image-svg()` and `.background-image-svg-quick()` (provided by mediawiki.mixins.less), which have been deprecated since 1.35, have now been removed. MediaWiki no longer supports any browser which would require this SVG-fallback PNG support, so you can simply use the regular CSS `background-image:` declaration instead.
  • The ResourceLoader module `mediawiki.legacy.oldshared` and its file 'oldshared.css', deprecated since 1.35 has been removed (task T248357).
  • `ResourceLoader::__construct` now requires a Config parameter. The optional nature of this parameter was deprecated in 1.34.
  • The LinkBegin and LinkEnd hooks, deprecated in 1.28, have been removed. You can instead use the HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd hooks, respectively.
  • The EmailUser hook passes its fifth param, $error, by reference, to allow hook handlers to add error messages, indicate that they have sent the email instead of core, etc. Setting the parameter to something other than a Status object, true, false, an empty string, an array, or a MessageSpecifier, object, which had been deprecated in 1.29, is no longer supported, and now results in an MWException being thrown.
  • Skin::getDynamicStylesheetQuery(), deprecated in 1.32, has been removed. You should use action=raw&ctype=text/css directly.
  • Skin::makeI18nUrl(), deprecated in 1.35, has been removed.
  • The following User methods, deprecated and moved to BlockManager in 1.34, were removed:
    • ::isDnsBlacklisted
    • ::inDnsBlacklist
    • ::isLocallyBlockedProxy
    • ::trackBlockWithCookie
  • Support for v1 of the parser tests file format has been removed; it was deprecated in 1.35. (task T174199)
  • SpecialUnblockUser::processUIUnblock() now returns a Status object instead of an array of messages or a boolean value. This function was also marked as @internal and is no longer safe to call it publicly.
  • mw.Title.getDotExtension() from the 'mediawiki.Title' module was removed without deprecation. You should use mw.Title.getExtension() and prepend the dot if need be.
  • Profiler::getTemplated and Profiler::setTemplated, deprecated in 1.34, have been removed.
  • Removed HookContainer::getOriginalHooksForTest() without deprecation. This method was introduced in 1.35 for internal use, and appears unused outside of MediaWiki core.
  • ParserCache::__construct() now requires three parameters.
  • Message->getFormat(), deprecated in 1.29, has been removed.
  • Support for passing Article to ParserCache::get, deprecated in 1.35, has been removed.
  • ParserCache::singleton(), deprecated in 1.30, has been removed.
  • DatabaseBlock::deleteIfExpired and ::fromMaster, deprecated in 1.35, have been removed.
  • Some deprecated AbstractBlock methods have been removed:
    • ::prevents, deprecated in 1.33
    • ::shouldTrackWithCookie, deprecated in 1.34
    • ::getBlocker, deprecated in 1.35
    • ::setBlocker, deprecated in 1.35
    • ::getBlockErrorParams, deprecated in 1.35
  • Multiple DatabaseBlock methods dealing with cookies, deprecated in 1.34, have been removed:
    • ::setCookie
    • ::clearCookie
    • ::getCookieValue
    • ::getIdFromCookieValue
    • ::shouldTrackWithCookie
  • The public static callback function SpecialUnblock::processUIUnblock has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
  • ChangeTags::truncateTagDescription, deprecated in 1.35, has been removed.
  • Deprecated null fallbacks in PasswordReset constructor have been removed.
  • User::isEveryoneAllowed and User::getAllRights, deprecated in 1.34, has been removed.
  • The following methods of the UserGroupMembership class, deprecated in 1.35, has been removed:
    • ::initFromRow
    • ::newFromRow - use UserGroupManager::newGroupMembershipFromRow
    • ::selectFields - use UserGroupManager::getQueryInfo
    • ::delete - use UserGroupManager::removeUserFromGroup
    • ::insert - use UserGroupManager::addUserToGroup
    • ::purgeExpired - use UserGroupManager::purgeExpired
    • ::getMembershipsForUser - use UserGroupManager::getUserGroupMemberships
    • ::getMembership - use UserGroupManager::getUserGroupMemberships
  • The public static callback function SpecialBlock::validateTargetField has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
  • The public static callback function SpecialUploadStash::tryClearStashedUploads has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
  • SpecialComparePages::showDiff() ::revOrTitle(), ::checkExistingTitle(), and ::checkExistingRevision() were marked as @internal to allow for breaking changes. They are no longer safe to call. The methods were unused outside of MediaWiki core.
  • Each special page within core now uses service injection via it constructor. When extending these special pages, a call to the grandparent constructor (`SpecialPage::__construct()`) in the sub-class would now break the derived special page, as the fallback code in the parent constructor cannot set the services as needed. Be sure to call the parent constructor when extending core special pages. Extending core's special pages is not part of the stable interface, and should generally be avoided.
  • Language::getExtraUserToggles and ::viewPrevNext, deprecated in 1.34, have been removed.
  • StreamFile::send404Message and ::parseRange, deprecated in 1.34, have been removed.
  • SVGMetadataExtractor class, deprecated in 1.34, has been removed.
  • ProcessCacheLRU class, deprecated in 1.32, has been removed.
  • wfForeignMemcKey(), deprecated in 1.35, has been removed.
  • LoadBalancer::safeWaitForMasterPos(), deprecated in 1.34, has been removed.
  • JobQueue::factory() now requires its `idGenerator` option. The optional nature of this option was deprecated in 1.35.
  • ApiFeedRecentChanges::getFeedObject has been changed to private, and appears unused outside of MediaWiki core.
  • Skin::subPageSubtitle() has been changed to private method. Callers should use Skin::prepareSubtitle().
  • RevisionDeleter::checkRevisionExistence was removed without deprecation. It had no known callers.
  • wfForeignMemcKey() and wfMemcKey(), deprecated in 1.35, have been removed.
  • MediaWiki now also requires the php-intl extension.
  • BotPassword::save() now returns a Status object for the result rather than a bool.
  • The methods in CoreTagHooks have been marked @internal and type hints have been added. The methods appeared to be unused outside of MediaWiki core.
  • SquidPurgeClient and SquidPurgeClientPool, deprecated since 1.35, have been removed.
  • Several methods on WikiPage will now throw an exception when called on a WikiPage instance that where constructed on a title that does not refer to a proper page (but rather a special page or interwiki link). The behavior was previously undefined and could in some cases lead to data corruption. Affected methods are: getId(), insertOn(), newPageUpdater(), doUpdateRestrictions(), doDeleteArticleReal(), doRollback(), and doEditContent().
  • The ParserTestRunner no longer invokes the ParserTestTables hook. Instead, it clones all database tables before running tests, like MediaWikiIntegrationTest does. If an extension was mis-using the hook to *exclude* tables from the clone, that will no longer occur, and tests may fail.
  • The following classes, which were only loaded for tests and had no uses found in public MediaWiki-related git, were removed:
    • MockWebRequest
    • UserWrapper
  • Passing Title as a second parameter to RevisionStore::getPreviousRevision and getNextRevision, hard deprecated since 1.31, was prohibited.
  • (task T275619) Maintenance::hasOption and Maintenance::getOption now behave as documented and are not altered by previous calls to these methods.
  • The internal class FirejailCommand was removed.
  • Command::execute() now returns a Shellbox\Command\UnboxedResult instead of a MediaWiki\Shell\Result. Any type hints should be updated.
  • WikiPage::$mIsRedirect was removed.
  • ObjectCache::detectLocalServerCache(), deprecated in 1.35, was removed.
  • The following functions from the Title class have been removed:
    • countRevisionsBetween
    • getAuthorsBetween
  • The PageProps class was converted to a service. PageProps::overrideInstance was removed, and MediaWikiServices::redefineService should be used instead.
  • Support for creating a MediaWikiTitleCodec object without the InterwikiLookup and NamespaceInfo services, deprecated in 1.34, was removed. Note that the MediaWikiTitleCodec class is not @newable or @stable to create, and should be retrieved from MediaWikiServices instead.
  • The $wgContLang variable, deprecated in 1.32, was removed. You can instead use MediaWikiServices::getInstance()->getContentLanguage().
  • User::clearAllNotifications(), hard deprecated in 1.35, was removed. Use WatchlistManager::clearAllUserNotifications() instead.
  • DatabaseBlock::getBlocker can return any UserIdentity instance, not just User.
  • MediaWiki::triggerJobs(), deprecated in 1.34, was removed.
  • The following Article methods, deprecated in 1.35, were removed:
    • checkFlags
    • checkTouched
    • clearPreparedEdit
    • doDeleteUpdates
    • doEditUpdates
    • doPurge
    • doViewUpdates
    • exists
    • followRedirect
    • getAutoDeleteReason
    • getCategories
    • getContentHandler
    • getContentModel
    • getContributors
    • getDeletionUpdates
    • getHiddenCategories
    • getId
    • getLatest
    • getLinksTimestamp
    • getMinorEdit
    • getOldestRevision
    • getRedirectTarget
    • getRedirectURL
    • getRevision
    • getTouched
    • getUndoContent
    • hasViewableContent
    • insertOn
    • insertRedirect
    • insertRedirectEntry
    • isCountable
    • isRedirect
    • loadFromRow
    • loadPageData
    • lockAndGetLatest
    • makeParserOptions
    • pageDataFromId
    • pageDataFromTitle
    • prepareContentForEdit
    • protectDescription
    • protectDescriptionLog
    • replaceSectionAtRev
    • replaceSectionContent
    • setTimestamp
    • shouldCheckParserCache
    • supportsSections
    • triggerOpportunisticLinksUpdate
    • updateCategoryCounts
    • updateIfNewerOn
    • updateRedirectOn
    • updateRevisionOn
    • doUpdateRestrictions
    • updateRestrictions
    • doRollback
    • commitRollback
    • generateReason
  • The monolog-based logging system has dropped the Avro format. Because of this, the AvroFormatter class and the AvroValidator utility class have been removed without deprecation.
  • AbstractBlock::$mReason, deprecated in 1.34, was removed. Use AbstractBlock::getReasonComment and AbstractBlock::setReason instead.

Deprecations in 1.36 edit

  • (task T278026) The DB_MASTER constant has been deprecated in favour of DB_PRIMARY.
  • (task T245963) User::getGrantName() is now hard deprecated and will be removed in a subsequent release. Use MWGrants::grantName() instead.
  • wfIncrStats() is now deprecated. Use MediaWikiServices::getInstance() ->getStatsdDataFactory()->updateCount() instead.
  • WikiPage::doEditContent() is now deprecated. Use WikiPage::doUserEditContent() instead. Note that doEditContent() was also deprecated in 1.32 for unrelated reasons and doUserEditContent() is deprecated for other reasons, however, using doUserEditContent() is recommended over using doEditContent().
  • WikiPage::doUserEditContent() is now deprecated. Use PageUpdater::saveRevision instead. Note that the new method expects callers to take care of checking EDIT_MINOR against the minoredit right, and to apply the autopatrol right as appropriate.
  • LocalFile::recordUpload2, soft deprecated in 1.35, now emits deprecation warnings. Use ::recordUpload3 instead.
  • Constructing a new instance of the ParserOptions class without providing a User object, which falls back to the global $wgUser, is now deprecated.
  • The User class, which was marked as @newable in 1.35, is no longer newable, meaning that it is no longer safe to manually call the constructor via `new User`. Instead, use the UserFactory service. Additionally, the following static constructor methods were deprecated in favor of using the UserFactory service:
    • User::newFromName
    • User::newFromId
    • User::newFromActorId
    • User::newFromIdentity
    • User::newFromAnyId
    • User::newFromConfirmationCode
  • The following User methods have been hard deprecated in favor of the new UserEditTracker service:
    • User::getFirstEditTimestamp
    • User::getLatestEditTimestamp
  • The confusingly-named User->isLoggedIn() method has been deprecated in favour of the method it wraps, User->isRegistered().
  • Use of the `preprocessor=Preprocessor_DOM` option in parser test files has been deprecated. Preprocessor_DOM was removed in 1.35.
  • ParserOptions::setTidy() has been deprecated. It has had no effect since1.35.
  • Sanitizer::escapeIdReferenceList() has been deprecated; it will eventually be made private to the class, as it appears to have no uses outside the Sanitizer class.
  • Sanitizer::hackDocType() is deprecated; it will eventually be made private.
  • Skin::getIndicatorsHTML() is deprecated. The functionality can be retained by reimplementing the method using the raw indicators data from OutputPage::getIndicators.
  • Skin::makeVariablesScript() has been deprecated. Use ResourceLoader::makeInlineScript() instead.
  • SpecialPageFactory::getRestrictedPages() has been deprecated. Use SpecialPageFactory::getUsablePages() instead.
  • Title::nameOf() is deprecated; use Title::newFromID()->getPrefixedDBkey() instead.
  • DatabaseBlock::insert, DatabaseBlock::update, DatabaseBlock::purgeExpired and DatabaseBlock::delete are deprecated. Use DatabaseBlockStore::insertBlock, DatabaseBlockStore::updateBlock, DatabaseBlockStore::purgeExpiredBlocks and DatabaseBlockStore::deleteBlock instead.
  • SpecialBlock::getTargetAndType and AbstractBlock::parseTarget are deprecated. Call BlockUtils::parseBlockTarget instead.
  • SpecialUnblock::processUnblock was deprecated - use UnblockUserFactory service instead.
  • Deprecated MediaWikiIntegrationtestCase::removeTemporaryHook() in favor of MediaWikiIntegrationtestCase::clearHook().
  • Skin::getSearchLink(), also exposed as 'searchaction' option in SkinTemplate, has been deprecated. Use Title or SpecialPage methods directly.
  • Skin::getAllowedSkins and ::getSkinNames have been deprecated. Use their respective equivalents in SkinFactory instead.
  • The RollbackComplete hook has been deprecated, use the PageSaveComplete hook instead.
  • Skin::makeUrl() has been deprecated. Title methods should be used instead.
  • Skin::privacyLink(), Skin::disclaimerLink() and Skin::aboutLink() have been deprecated. Please use Skin::footerLink() instead.
  • Skin::getLogo() has been deprecated. Use ResourceLoaderSkinModule instead.
  • The module `mediawiki.toc.styles` has been replaced by ResourceLoaderSkinModule. If you are having problems styling table of contents ensure you have an updated skin.
  • Skin::mainPageLink() has been deprecated. Use LinkRenderer service instead.
  • BaseTemplate::getToolbox() method has been hard deprecated. The toolbox data is now available in a sidebar data array which you can get from any class that's extending QuickTemplate class.
  • Constructing a DefaultPreferencesFactory, LinkHolderArray or PasswordReset without a $hookContainer parameter is deprecated.
  • Autopromote class, soft deprecated since 1.35, now emits deprecation warnings. Use UserGroupManager instead.
  • SpecialBlock::canBlockEmail has been deprecated. Please use BlockPermissionChecker::checkEmailPermissions instead.
  • SpecialBlock::checkUnblockSelf has been deprecated. Please use BlockPermissionChecker::checkBlockPermissions instead.
  • SpecialBlock::parseExpiryInput was deprecated - use BlockUser::parseExpiryInput instead.
  • SpecialBlock::validateTarget has been deprecated, use BlockUtils instead.
  • SpecialBlock::validateTargetField has been deprecated for external use, use BlockUtils instead.
  • SpecialPage::getLanguageConverter has been deprecated, use LanguageConverterFactory::getLanguageConverter() directly.
  • ParserCache::getKey has been deprecated. Use ParserCache::getMetadata and ParserCache::makeParserOutputKey instead.
  • The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4, was removed. MediaWiki support for PHPUnit 4 ended with the removal of HHVM support.
  • The PHPUnit6And8Compat class, used to provide compatibility with PHPUnit 6, was removed without deprecation. This class was introduced during the upgrade to PHPUnit 8, but never used.
  • MediaWikiIntegrationTestCase::assertType, hard-deprecated in 1.35 due to incompatibility with PHPUnit 8, was removed.
  • ParserCache::getETag has been deprecated, instead build suitable etag explicitly.
  • The following functions from the Language class have been hard deprecated and will be removed in a subsequent release:
    • findVariantLink
    • convertTitle
    • updateConversionTable
    • commafy
  • The following functions from the Title class have been hard deprecated:
    • getPreviousRevisionID
    • getNextRevisionID
    • getEarliestRevTime
  • The following functions from the User class have been hard deprecated:
    • getDefaultOptions
    • getDefaultOption
  • The mw.language.commafy client-side method has been deprecated, to match the deprecation of Language::commafy. Use mw.language.convertNumber instead.
  • The "es6-promise" module has been deprecated. Use "es6-polyfills" instead.
  • Title::isDeleted() and Title::isDeletedQuick() have been deprecated. Please use Title::getDeletedEditsCount() and Title::hasDeletedEdits() instead.
  • Article::getContentObject, soft-deprecated since 1.32, was hard-deprecated.
  • WikiRevision::importUpload, soft-deprecated since 1.31, was hard-deprecated.
  • Html::infoBox() has been deprecated. There's no replacement.
  • Message::toString() without a $format parameter, soft-deprecated since 1.28, was hard-deprecated. Use explicit formatting methods instead, such as Message::text() and Message::escaped().
  • BagOStuff::makeKeyInternal() usage outside of BagOStuff has been deprecated.
  • BagOStuff::setDebug() is deprecated and calls to it are ignored. Debug logs are now unconditionally enabled.
  • The following global functions have been hard deprecated:
    • wfAppendToArrayIfNotDefault
    • wfAcceptToPrefs
    • wfClearOutputBuffers
    • wfConfiguredReadOnlyReason
    • wfDebugMem
    • wfGetPrecompiledData
    • wfNegotiateType
  • BeforeParserFetchTemplateAndtitleHook has been deprecated; replace with the new BeforeParserFetchTemplateRevisionRecord hook. (The similar ParserFetchTemplateHook was deprecated in 1.35; the new hook replaces both.)
  • The InterwikiLoadPrefix hook has been deprecated; it is not compatible with future wikitext parsers (which need to enumerate all interwiki prefixes). In test cases please use $wgInterwikiCache instead.
  • WikiPage instances should no longer be constructed for titles that do not represent editable pages (e.g. special pages). WikiPages were always documented to represent "MediaWiki article and history".
  • Skin::getSkinStylePath() has been deprecated. Please replace usages with the direct path to the resources.
  • The second argument of EnhancedChangesList::getDiffHistLinks, $query, has been deprecated.
  • The ParserTestTables hook has been deprecated; it is no longer necessary after a ParserTestRunner refactoring.
  • The following classes have been hard deprecated: CachedAction, SpecialCachedPage, CacheHelper, ICacheHelper. They were unused in MediaWiki ecosystem, so no replacement was provided.
  • The ProtectionForm::buildForm hook has been deprecated. Please use the ProtectionFormAddFormFields hook instead.
  • RevisionStore::newMutableRevisionFromArray has beed hard deprecated. Instead, MutableRevisionRecord should be constructed directly via constructor.
  • UserIdentity::getActorId() is deprecated. The actor ID should not be exposed to application logic. Storage layer code should use the ActorNormalization service for normalizing and denormalizing user names.
  • Constructing a UserIdentityValue with an actor ID as the third parameter is deprecated. The parameter should be omitted. Storage layer code should use the ActorNormalization service for normalizing and denormalizing user names.
  • Command::cgroup() is deprecated and no longer functional. $wgShellCgroup is now implemented as an Executor option.
  • Command::restrict() is deprecated. Instead use the new separate accessors.
  • MWTidy::tidy() is deprecated. Use MediaWikiServices::getTidy()-tidy() instead.
  • TidyDriverBase::supportsValidate() is deprecated; it has always returned false since 1.33.
  • WatchedItem::getUser hard-deprecated in favor of ::getUserIdentity.
  • WatchedItemStoreInterface::enqueueWatchlistExpiryJob was hard deprecated in favor of the new method maybeEnqueueWatchlistExpiryJob that takes care of relevant configuration checks.
  • LogEntry::getPerformer() and its implementations have been hard-deprecated, in favor of ::getPerformerIdentity().
  • AuthManager::singleton(), deprecated in 1.35, is hard deprecated. Use MediaWikiServices::getAuthManager() instead.
  • User::clearNotification(), deprecated in 1.35, is hard deprecated. Use WatchlistManager::clearTitleUserNotification() instead.
  • Passing string to DatabaseBlock::setBlocker was deprecated. Only UserIdentity is now allowed.
  • DatabaseBlock constructor 'byText' option was deprecated in favour of 'by' option, which now accepts UserIdentity. Passing user ID is deprecated.
  • Parser::getUser was deprecated. Use Parser::getUserIdentity instead.
  • DatabaseBlock::isWhitelistedFromAutoblocks was deprecated. Use DatabaseBlock::isExemptedFromAutoblocks instead.
  • User::isIPRange(), deprecated in 1.35, is hard deprecated. Use the UserNameUtils service or IPUtils directly.
  • BaseTemplate::getFooterIcons(), deprecated in 1.35, is hard deprecated. Read footer icons from template data requested via $this->get('footericons').
  • `box-shadow()` LESS mixin from mediawiki.mixins is deprecated due to updated basic browser support. Use unprefixed property `box-shadow:` instead.
  • MergeHistory::checkPermissions was deprecated. Use ::probablyCanMerge or ::authorizeMerge instead.
  • User::isValidUserName(), deprecated in 1.35, is hard deprecated. Use the UserNameUtils service instead.
  • The TitleArrayFromResult hook has been deprecated.
  • The EditPageBeforeEditToolbar hook has been deprecated; it has become defunct after the classic edit toolbar was removed. Use one of the many other EditPage hooks instead.
  • Deprecated the class name MediaWiki\User\WatchlistNotificationManager; use MediaWiki\Watchlist\WatchlistManager instead. Deprecated the method MediaWikiServices->getWatchlistNotificationManager(); use MediaWikiServices->getWatchlistManager() instead.
  • The "ArticleEditUpdatesDeleteFromRecentchanges" hook, deprecated in 1.35, has been removed. Other hooks like "RecentChange_save" can be used instead.

Other changes in 1.36 edit

  • The 'tidy' key in ParserOptions (used in the parser cache) has been removed. It has had no effect since 1.35.
  • A future release of MediaWiki will make `=` a built-in parser function, for use when automatically escaping the `=` character in template arguments. A tracking category and parser warning have been added to this release when `=` is used and it expands to something other than `=`.
  • The implementation of TestFileReader::read has been changed to use Parsoid's parser test file parser. This should be compatible with existing code, but it only supports version 2 of the test file specification and may be more strict when parsing invalid input, including duplicate tests.
  • BeforeParserFetchTemplateRevisionRecord, a new hook, unifies and replaces the old BeforeParserFetchTemplateAndtitleHook and ParserFetchTemplateHook.
  • The SkinLessImportPaths attribute was added, allowing skins to add a directory to the import path for LESS stylesheets. Skins can use this to provide a custom version of mediawiki.skin.variables.less, setting skin-specific values for certain LESS variables.
  • The interaction between ContentHandler::getParserOutputForIndexing() and ContentHandler::getDataForSearchIndex() has been clarified (the latter should only be called with the result of the former). Extensions may override getParserOutputForIndexing() to skip generating HTML, which may improve indexing performance. (The default implementation still generates HTML, and getDataForSearchIndex() implementations can still rely on it if they do not over-ride getParserOutputForIndexing().)
  • Article::fetchContentObject, ::mContentObject, ::mContentLoaded, ::mRevIdFetched, all deprecated since 1.32, were removed.
  • Article::mParserOptions and ::setParserOptions were removed.
  • Article and ImagePage::getEmptyPageParserOutput, unused, were removed.
  • ParserCache's default serialization format was changed from PHP serialization to JSON serialization. In case some installed extension do not support JSON yet, $wgParserCacheUseJson can be used to revert back to PHP serialization.
  • PermissionManager::groupHasPermission, ::getGroupPermissions and ::getGroupsWithPermission were deprecated, use GroupPermissionsLookup service instead.
  • WatchedItemStoreInterface now accepts PageIdentity where it accepted LinkTarget, calling with LinkTarget was deprecated.
  • 'movable' attribute has been added to the 'namespaces' property of extension.json schema. Extensions that define namespaces can set it to `false` to disallow moving pages in the specified namespace. Extensions should either use this or NamespaceIsMovableHook, but not both. The hook overides the attribute.

Compatibility edit

MediaWiki 1.36 requires PHP 7.3.19 or later and the following PHP extensions:

  • ctype
  • dom
  • fileinfo
  • iconv
  • intl
  • json
  • mbstring
  • xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used, but support for them is somewhat less mature.

The supported versions are:

  • MySQL 5.5.8 or later
  • PostgreSQL 9.4 or later
  • SQLite 3.8.0 or later

Online documentation edit

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list edit

A mailing list is available for MediaWiki user support and discussion:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help edit

There's usually someone online in the IRC channel #mediawiki connect.

MediaWiki 1.37 edit

MediaWiki 1.37.6 edit

This is a maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.5 edit

  • Fix missing use statement from backport of fix for task T307278.

MediaWiki 1.37.5 edit

This is a security and maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.4 edit

  • Localisation updates.
  • (task T312519, task T312520) Parser::extensionSubstitution() Don't run substr() on null.
  • (task T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
  • (task T312302) SpecialRedirect: Don't pass null to explode.
  • RemoveInvalidEmails: Fix quoting for postgres.
  • (task T312678) import: UploadSourceAdapter::stream_read() don't pass null to strlen().
  • (task T312300) SpecialDiff: Don't pass null to explode().
  • (task T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
  • (task T289926) Handle null passed to wfShorthandToInteger() and Html::element().
  • (task T289926) Ensure that strlen() does not get passed a (valid) null.
  • (task T312301) SpecialDiff: Don't pass null to trim().
  • Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
  • (task T289926) Ensure we don't pass null to mb_strlen.
  • (task T312305, task T311572, task T311571, task T311578) HtmlForm: Null coalescence in trim() calls.
  • (task T289926) site: Consistently return null from Site::getDomain().
  • (task T307304, task T289879) filebackend,jobqueue: Add signature for FilterIterator::accept().
  • (task T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
  • Add application/vnd.ms-opentype to MIME list.
  • Allow composer/installers plugin in composer.json.
  • Change type hints for BatchRowIterator and NotRecursiveIterator for compatibility with PHP 8.1.
  • (task T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
  • (task T313663) parser: Mock WikiPage::getContentModel in ParserCacheTest to fix php8.1.
  • (task T313663) [php8.1] Make WikiImporterFactoryTest use better mock for ImportSource.
  • Fix tests so getName() doesn't return null.
  • (task T313663) [php8] Don't use strlen on potentially null string.
  • (task T313663) [php8.1] Suppress test warning about providing null.
  • (task T313663) Parser will use current timestamp instead of null if passed a RevisionRecord that does not have a timestamp.
  • (task T313663) Add explicit null check for $sha in FileBackend [php8.1].
  • (task T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
  • (task T313663) Mock UserOptionsManager::getOption for php8.1.
  • (task T289879, task T289926) Get rid of warnings on PHP 8.1.
  • (task T313663) Check for null return of preg_replace in MediaWikiTitleCodec.
  • (task T313663) cast db name to string when checking if it is read only [php8.1].
  • (task T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
  • Fix a couple deprecation warnings in the installer under PHP 8.1.
  • (task T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
  • (task T313663) Mock User::getTitleKey in SpecialPreferencesTest [php 8.1].
  • (task T314096) Migrate use of ${var}-style string interpolation.
  • (task T314099) preprocessor: Add missing field declarations.
  • (task T313663, task T313662) Make default value for optional args 0 be not null.
  • (task T314225) SpecialCategories: Null coalescene $par.
  • (task T314099) User: Allow dynamic properties on PHP 8.2.
  • (task T314397) SpecialBlock: Better handle null in getTargetUserTitle.
  • (task T314099) phpunit: Fix trivial dynamic property usages in tests.
  • (task T314405) UploadStash: Check if us_prop is set in the fileMetadata.
  • (task T313663) Make ChangesListSpecialPageTest cast to string for php 8.1.
  • (task T313663) Do not test giving a null fragment to Title::makeTitle.
  • (task T314550) SpecialMergeHistory: Set timestamp to if no mergepoint.
  • (task T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
  • api: Add rel=nofollow to help examples.
  • (task T307613) Validate length of user email on Special:ChangeEmail/Special:CreateAccount.
  • (task T314226) LoginSignupSpecialPage: Check if $value is a string before length.
  • (task T314824) tests: Update parser test after i18n change.
  • (task T295958, task T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
  • (task T314906, task T314907) SpecialBlock: Set defaults for wpPageRestrictions and wpNamespaceRestrictions.
  • (task T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
  • (task T315892) composer.json: Pin phpunit to 8.5.28.
  • (task T313049) Bump wikimedia/parsoid to v0.14.2.
  • (task T317750) session: Fix broken SessionTest case due to PHPUnit dependency change.
  • (task T318079) SpecialEditTags: Set default value of wpTagsToRemove to empty array.
  • (task T318460) SpecialChangeEmail: Set default for returntoquery.
  • (task T318307) Update docs for HTMLFormField::validate() to permit all data types.
  • (task T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results in an IP range check on Special:Contributions.
  • (task T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence of hidden users.
  • (task T307278, CVE-2022-41766) SECURITY: On action=rollback the message "alreadyrolled" can leak revision deleted user name.

MediaWiki 1.37.4 edit

This is a maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.3 edit

  • Localisation updates.
  • (task T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
  • (task T311559) SpecialListFiles: user parameter isn't always present.
  • (task T311561) ImageListPager: Don't call htmlspecialchars() on null.
  • (task T311920) SpecialBlockList: Prevent passing null to trim().
  • (task T311921) SpecialUserrights: Don't pass null to str_replace.
  • (task T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize().
  • (task T311574, task T311576) SpecialLinkSearch: Don't pass null through to the parser.
  • (task T312059) Update guzzlehttp/guzzle to 7.4.5 in vendor.
  • (task T296435, task T297669) cache: Add four fields to LinkCache::getSelectFields.

MediaWiki 1.37.3 edit

This is a security and maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.2 edit

  • Localisation updates.
  • (task T289879) Type hints for ArrayAccess and JsonSerializable.
  • (task T304783) TemplateParser: avoid warnings when called by NoLocalSettings.
  • Rebuilt vendor with composer 2.3.3.
  • Fix old_name in UserLogoutComplete hook.
  • (task T289879) Address some deprecations for PHP 8.1.
  • (task T193565) UserGroupManager: Fix dbDomain in addUserToGroup() deferred update.
  • (task T309114) LocalFile::prerenderThumbnails: Limit the number of thumbnail jobs triggered.
  • (task T307982) Updated wikimedia/parsoid from v0.14.0 to v0.14.1.
  • (task T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
  • (task T308473) SECURITY: Escape contributions-title msg for use within page title.
  • (task T311272) Call parent constructor of AddSite maintenance script first.
  • MediaWiki: Don't eagerly initialize action name.
  • Updated wikimedia/shellbox from v2.0.0 to v2.1.1.
  • (task T311384, CVE-2022-27776) Updated guzzlehttp/guzzle from 7.2.0 to 7.4.5.
  • (task T289926) Avoid passing null to trim() in SkinTemplate.
  • (task T311473) rollbackEdits: Pass user identity to RollbackPage.
  • (task T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
  • (task T311551) ShellboxClientFactory::getUrl(): Check if $this->key is null.
  • (task T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
  • (task T311569) FileBackend::isStoragePath() Handle being passed null.
  • (task T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
  • (task T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
  • (task T281741) ChangeTags: Fix adding CSS classes for hidden tags.
  • (task T296642) changetags: Fix management of a '0' tag.
  • (task T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
  • (task T303033) Handle null in ChangeTags::modifyDisplayQuery.
  • Updated wikimedia/common-passwords from 0.3.0 to 0.4.0.

MediaWiki 1.37.2 edit

This is a security and maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.1 edit

  • (task T298261) Fix support for Composer 2.2.
  • (task T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
  • Update doctrine/dbal (3.0.0 => 3.1.5).
  • (task T296898) Add entry point name to disabled Session exception if possible.
  • (task T298564) MemcachedClient: Add support for IPv6.
  • (task T297543, CVE-2022-28202) SECURITY: properly escape output used within galleries and Special:RevisionDelete.
  • (task T289956) WatchAction: Fix bug that prevents showing proper success message in the noscript fallback mode.
  • (task T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
  • (task T283275) Fix PHP 8.0 failure of RefreshSecondaryDataUpdateTest.
  • (task T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
  • (task T275673) objectcache: Avoid getCurrentTime() call in MapCacheLRU::has().
  • (task T275673) objectcache: split up MapCacheLRU::getAge() to avoid conditional overhead.
  • Fix the json schema and the extension processor for Parsoid extension modules.
  • (task T299696) update.php: Avoid passing null to substr.
  • (task T195807, task T256401) Fix signature of DatabasePostgres::buildGroupConcatField.
  • In PHP 8.1 don't throw exceptions from mysqli.
  • (task T289926) SiteConfiguration: Don't pass null to str_replace().
  • (task T264735) Fix deprecation warning from CURLPIPE_HTTP1.
  • (task T260735) Stop using is_resource() where possible.
  • (task T289879) Apply ReturnTypeWillChange to various implementations of built in interfaces.
  • (task T299312) Implement __serialize/__unserialize for PHP 8.1 support.
  • ExtensionRegistry: Add process cache for lazy attributes.
  • (task T301041) ApiPageSet: Add "missing": true to missing revisions.
  • Allow ParsoidModules extension schema to register services.
  • (task T300462) SpecialUndelete: Do not show empty comments as deleted.
  • (task T297708) Allow setting max execution time to several special pages.
  • (task T205349) LinkCache: Try invalidating cache before throwing.
  • (task T302540) composer.json: Add ext-calendar to require.
  • (task T302540) composer.json: Add ext-simplexml to require-dev.
  • (task T302540) composer.json: Add various PHP extensions to suggests.
  • Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
  • (task T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
  • (task T293576) listFiles: Display file name instead of version.
  • (task T303871) Fix @since of Title::getId().
  • (task T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
  • wrapOldPasswords: add \n to two output calls.
  • (task T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion loop if it points to a local interwiki.
  • (task T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file uploads with actor as a condition can result in a DoS.
  • (task T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when a page is used on a extremely large number of other pages.

MediaWiki 1.37.1 edit

This is a security and maintenance release of the MediaWiki 1.37 branch.

Changes since MediaWiki 1.37.0 edit

MediaWiki 1.37.0 edit

Changes since MediaWiki 1.37.0-rc.2 edit

  • Remove justinrainbow/json-schema from vendor.
  • Updated pear/mail_mime from 1.10.9 to 1.10.11.
  • Update deprecated Guzzle Psr7 function calls.
  • (task T281972) UserIdentityValue: Correct @since tags.
  • Updated wikimedia/parsoid from v0.14.0-a19 to v0.14.0.
  • Localisation updates.
  • Tweak error message for missing composer dependencies.

MediaWiki 1.37.0-rc.2 edit

Changes since MediaWiki 1.37.0-rc.1 edit

  • (task T295173) Re-add wikimedia/normalized-exception to vendor.
  • Remove wikimedia/testing-access-wrapper, psr/simple-cache, psr/http-factory from vendor.
  • (task T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is set.
  • (task T212428) Allow populateContentTables to continue when there are bad blobs.

MediaWiki 1.37.0-rc.1 edit

Changes since MediaWiki 1.37.0-rc.0 edit

  • (task T294043) checkStorage: pass no parameters to WikiRevision::getContent().
  • (task T292763,CVE-2021-44856) SECURITY: Do not cache private wiki completion results.
  • (task T293783) ApiQueryImageInfo: don't show empty comments as deleted.
  • (task T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
  • (task T294796) JobQueueRedis: Replace deprecated zSize with zCard.
  • Remove duplicate settings from DefaultSettings.
  • (task T278037) NoLocalSettings: Pass an EmptyBagOStuff to TemplateParser.

MediaWiki 1.37.0-rc.0 edit

Upgrading notes for 1.37 edit

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.37 upgrades are below:

  • (task T280806) Deprecated methods of fetching API tokens have been removed. This may cause older bots and scripts to fail. Most queries are trivially updateable to using new methods. See the Action API changes section below for more information.

For notes on 1.36.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.37 edit

  • (task T242768) The PasswordCannotMatchUsername password policy has been removed, please use PasswordCannotBeSubstringInUsername instead. If you have not customised your password policies, there will be nothing to do here.

New configuration edit

  • $wgBrowserFormatDetection - This setting allows the enabling or disabling of automatic detection of possible phone numbers in a webpage in iOS Safari.
  • $wgParserEnableLegacyMediaDOM - This setting defaults to true, and enables the legacy media HTML structure in the output from the Parser. The alternative modern HTML structure for media is described at https://www.mediawiki.org/wiki/Parsing/Media_structure. In a future release of MediaWiki this option will default to false, so it's a good idea to test this setting on your wiki early and report any issues.

Changed configuration edit

  • $wgContentHandlerTextFallback - This migration setting, which defines how to react if a plain text version of a non-text Content object is requested using ContentHandler::getContentText(), is deprecated.
  • $wgActions – This setting lets sysadmins override which actions can be used. It has been re-worked to support injecting dependencies into Action sub-classes as part of wider work on dependency injection. Previously, $wgActions was an array where the keys were the names of actions, and the values had the following impacts (for a given key 'Foo'):
    • `true`: use the class 'FooAction' unless for a specific page WikiPage::getActionOverrides() wants to override that action
    • a string: use the class with that name, and do not allow over-riding on a per-page basis
    • `false`: the action is disabled
    • a callable: use the Action instance returned by invoking that callback, and do not allow overriding on a per-page basis
    • an object: use that specific Action instance, and do not allow overriding on a per-page basis.

As part of task T253078, values can now be arrays that are not callables, which are treated as ObjectFactory specs, allowing for services to be injected. Additionally, the distinction between values that allow per-page overrides and those that do not was removed - all actions can now be overridden on a per-page basis using WikiPage::getActionOverrides().

  • $wgShellboxUrl – This setting, new in 1.36 to configure the novel Shellbox encapsulation system, is now deprecated; use $wgShellboxUrls as a mapping of service => URL instead.
  • $wgIncludejQueryMigrate – This setting, introduced in 1.29 to on whether to provide a migration layer for jQuery, has now switched its default value from true to false. This may break gadgets that depended on methods that were removed in jQuery 3 in 2017. See task T280944 for more information.
  • A number of settings have been renamed. The former configuration variable names are deprecated, but will be used as the fall back if they are still set, and remain temporarily available for extensions which might try to read them:
    • $wgFileBlacklist is now $wgProhibitedFileExtensions
    • $wgMimeTypeBlacklist is now $wgMimeTypeExclusions
    • $wgEnableUserEmailBlacklist is now $wgEnableUserEmailMuteList
    • $wgShortPagesNamespaceBlacklist is now $wgShortPagesNamespaceExclusions
    • $wgMimeTypeExclusions - As well as being renamed, this configuration array now also prohibits the
Request for comment (RFC)
Releases
Component General
Creation date {{{created}}}
Author(s) {{{author}}}
Document status

form of JavaScript, 'application/javascript', as well as previous MIME types.

  • $wgFragmentMode - This setting, which determines the encoding of section IDs, has now switched its default value from legacy-first to html5-first: both the HTML5 anchor and the legacy percent-encoding-style anchor will still be generated for section titles, but references to them will use the HTML5 version, resulting in human-readable fragments.

Removed configuration edit

  • $wgLegacyJavaScriptGlobals, deprecated in 1.36.
  • (task T274695) $wgAjaxEditStash, deprecated in 1.36.
  • $wgShowDBErrorBacktrace, deprecated and non-functional since 1.32.
  • $wgShowSQLErrors, deprecated and non-functional since 1.32.
  • $wgLangObjCacheSize, without deprecation; the LanguageFactory service now always retains at most 10 objects in its LRU-cache.
  • $wgDjvuToXML, without deprecation; the tool it enables is obsolete and abandoned upstream. Use $wgDjvuDump to use that tool instead.

New user-facing features in 1.37 edit

  • (task T161934) MediaWiki now supports JPEG2000 files, to a limited extent.

External library changes in 1.37 edit

New external libraries edit

  • Added symfony/polyfill-php80 1.23.1.
  • Added whatwg-fetch 3.6.2.
  • Added wikimedia/normalized-exception 1.0.1.

Changed external libraries edit

  • Updated OOjs from v5.0.0 to v6.0.0
  • Updated OOjs-Router from v0.2.0 to v0.3.0
  • Updated OOUI from v0.41.3 to v0.42.0
  • Updated WVUI from v0.1.0 to v0.3.0
  • Updated cssjanus/cssjanus from v1.3.0 to v2.1.0.
  • Updated psr/container from v1.0.0 to v1.1.1.
  • Updated wikimedia/minify from v2.2.2 to v2.2.4.
  • Updated wikimedia/object-factory from v3.0.0 to v3.0.2.
  • Updated wikimedia/parsoid from v0.13.1 to v0.14.0-a19.
  • Updated wikimedia/relpath from v2.1.1 to v3.0.0.
  • Updated wikimedia/remex-html from v2.3.1 to v2.3.2.
  • Updated wikimedia/shellbox from v1.0.4 to v2.0.0.
  • Updated wikimedia/wait-condition-loop from v2.0.1 to v2.0.2.
  • Updated zordius/lightncandy from v1.2.5 to v1.2.6.
Changed development-only external libraries edit
  • Updated qunit from 2.10.0 to 2.16.0.

Removed external libraries edit

  • The pimple/pimple development-only library has been removed.

Action API changes in 1.37 edit

  • (task T280806) The API methods for fetching tokens which were deprecated in MediaWiki 1.24 have been removed. action=query&meta=tokens&type= should be used instead. Please note some token types no longer exist, and you should just use type=csrf for those instead.
    • action=query&prop=info&intoken -> action=query&meta=tokens&type=csrf
    • action=tokens&type= -> action=query&meta=tokens&type=
    • action=query&list=recentchanges&rctoken -> action=query&meta=tokens&type=csrf
    • action=query&prop=revisions&rvtoken=rollback -> action=query&meta=tokens&type=rollback
    • action=query&meta=userinfo&uiprop=preferencestoken -> action=query&meta=tokens&type=csrf
    • action=query&list=users&ustoken=userrights -> action=query&meta=tokens&type=userrights

Languages updated in 1.37 edit

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

  • (task T280435) LRM and RLM characters were removed from names of languages with parentheses in Names.php
  • (task T283422) Add namespace name translations and change the autonym of the Kinyarwanda language to "Ikinyarwanda".
  • (task T283423) Change the autonym of the Lombard language from "lumbaart" to "lombard".
  • (task T279619) Added language support for Dagbani (dag).
  • (task T282085) Added language support for Malay in Arabic (Jawi) script (ms-arab).
  • (task T283053) Added language support for Ojibwe (ojb).
  • (task T283480) Added language support for Wallisian (wls, Fakaʻuvea).
  • (task T284002) Added language support for Paiwan (pwn).
  • (task T284044) Added language support for Carpathian Romani (rmc).
  • (task T286460) Added language support for Gun (guw, Gungbe).
  • (task T287345) Added language support for Baoulé (bci).
  • (task T290126) Added language support for Kildin Sami (sjd).
  • (task T290408) Added language support for Pite Sami (sje).
  • (task T25216) Started the renaming of the language code for Norman from nrm to nrf.

Breaking changes in 1.37 edit

  • The Revision class, emitting deprecation warnings since 1.35, was removed entirely. As part of this, the following hooks that included a Revision object were removed:
    • ArticleRevisionUndeleted - use RevisionUndeleted
    • ArticleRollbackComplete - use RollbackComplete
    • DiffRevisionTools - use DiffTools
    • DiffViewHeader - use DifferenceEngineViewHeader
    • HistoryRevisionTools - use HistoryTools
    • NewRevisionFromEditComplete - use RevisionFromEditComplete
    • PageContentInsertComplete - use PageSaveComplete
    • PageContentSaveComplete - use PageSaveComplete
    • ParserFetchTemplate - use BeforeParserFetchTemplateRevisionRecord
    • RevisionInsertComplete - use RevisionRecordInserted
    • TitleMoveComplete - use PageMoveComplete
    • TitleMoveCompleting - use PageMoveCompleting
    • UndeleteShowRevision - no replacement
    • UserRetrieveNewTalks - no replacement
  • … the following methods and variables have been removed:
    • Article::$mRevision
    • Article::getRevisionFetched()
    • ContribsPager::tryToCreateValidRevision()
    • EditPage::$mBaseRevision
    • EditPage::getBaseRevision()
    • LinksUpdate::getRevision()
    • LinksUpdate::setRevision()
    • PageArchive::getArchivedRevision()
    • PageArchive::getPreviousRevision()
    • PageArchive::getRevision()
    • Parser::$mRevisionObject
    • Parser::fetchCurrentRevisionOfTitle()
    • Parser::getRevisionObject()
    • Parser::statelessFetchRevision()
    • ParserOptions::getCurrentRevisionCallback()
    • ParserOptions::setCurrentRevisionCallback()
    • Title::countAuthorsBetween()
    • Title::getFirstRevision()
    • User::getNewMessageLinks()
    • User::getNewMessageRevisionId()
    • User::setNewtalk()
    • WikiPage::getOldestRevision()
    • WikiPage::getRevision()
    • WikiPage::getUndoContent()
    • WikiPage::updateIfNewerOn()
  • … and the following methods no longer accept Revision objects as parameters:
    • CategoryMembershipChange::__construct()
    • ContentHandler::getUndoContent()
    • DerivedPageDataUpdater::prepareUpdate()
    • DifferenceEngine::getRevisionHeader()
    • Linker::buildRollbackLink()
    • Linker::generateRollback()
    • Linker::getRevDeleteLink()
    • Linker::getRollbackEditCount()
    • Linker::revComment()
    • Linker::revUserLink()
    • Linker::revUserTools()
    • WikiPage::doDeleteUpdates()
    • WikiPage::doEditUpdates()
    • WikiPage::hasDifferencesOutsideMainSlot()
    • WikiPage::onArticleEdit()
    • WikiPage::prepareContentForEdit()
    • WikiPage::updateRevisionOn()
  • The following methods return arrays that formerly included a 'revision' key that would emit deprecation warnings when accessed and return a Revision object. The Revision object has been removed from the arrays, and the 'revision-record' key should be used to get the relevant RevisionRecord instead:
    • PageUpdater::doCreate()
    • PageUpdater::doModify()
    • Parser::statelessFetchTemplate()
    • WikiPage::doEditContent()
  • Finally, the ParserOptions `templateCallback` option is a callback that is called in Parser::fetchTemplateAndTitle() and should return an array - the 'revision' key to that array used to be a Revision object and was used if no 'revision-record' was returned - is now ignored.
  • Previously, the classes RevisionTestModifyableContent and RevisionTestModifyableContentHandler were loaded for use in tests, but were only used within the tests for the since-removed Revision class. This content and content handler class were removed without deprecation.
  • WANObjectCache::HOLDOFF_NONE, deprecated since 1.35, was removed. Use WANObjectCache::HOLDOFF_TTL_NONE instead.
  • Calling ResourceLoader::makeVersionQuery() without $modules parameter, deprecated since MediaWiki 1.34, is no longer supported.
  • LocalFile::recordUpload2(), deprecated since 1.35, was removed.
  • The following methods and fields in the Language class, deprecated since 1.35, have been removed:
    • ::classFromCode()
    • ::clearCaches()
    • ::convertTitle()
    • ::findVariantLink()
    • ::$mConverter
    • ::updateConversionTable()
  • The following methods in the Parser class have been removed after having been deprecated in 1.35:
    • fetchTemplate()
    • Title()
  • (task T273354) When an edit is prevented by an 'EditFilterMergedContent' hook handler without changing the status, the edit form will now be displayed.
  • User::clearNotification(), which had been deprecated in 1.35, has been removed. Use WatchlistManager::clearTitleUserNotification() instead.
  • User::getNewtalk(), which had been deprecated in 1.35, has been removed. Use TalkPageNotificationManager::userHasNewMessages() instead.
  • The Autopromote class, deprecated since 1.35, was removed. Use UserGroupManager instead.
  • The CachedAction, SpecialCachedPage, CacheHelper, and ICacheHelper classes, all emitting deprecation warnings since 1.36, have been removed.
  • The hooks BeforeHttpsRedirect, CanIPUseHTTPS and UserRequiresHTTPS, deprecated in 1.35, were removed.
  • The TitleArrayFromResult hook, deprecated in 1.36, was removed.
  • The deprecated "es6-promise" alias ResourceLoader module has been removed. Use the "es6-polyfills" module directly instead.
  • The deprecated "mediawiki.legacy.protect" ResourceLoader module, deprecated since 1.36, has been removed. Use "mediawiki.action.protect" instead.
  • The JavaScript alias $j for references to jQuery, deprecated since 1.23, has been removed. Use $ instead.
  • The AuthenticationProvider interface and the SessionProvider class no longer extend the PSR LoggerAwareInterface concept, so they can't be typehinted as LoggerAwareInterface.
  • User::getGrantName(), emitting deprecation warnings since 1.36, has been removed. Use MWGrants::grantName() instead.
  • The following ApiBase methods, deprecated since 1.35, have been removed:
    • ApiBase::explodeMultiValue
    • ApiBase::parseMultiValue
    • ApiBase::validateLimit
    • ApiBase::validateTimestamp
  • The User::idCacheByName() public static field was removed without deprecation. Instead of using it, get a UserIdentity by name from the UserIdentityLookup service.
  • IDatabase::upsert() and IDatabase::replace() now only accept a single unique key. Previously, a warning was issued if there were multiple unique keys provided.
  • The MediaWiki:Autoblock_whitelist block exemption control was moved in 1.36 to MediaWiki:Block-autoblock-exemptionlist. The backward-compatibility of reading the old MediaWiki:Autoblock_whitelist page has now been dropped.
  • The following overridable methods in File hierarchy have changed signatures:
    • File::deleteFile() - now accepts UserIdentity instead of User
    • File::getDescription() - now accepts Authority instead of User
    • File::userCan() - now accepts Authority instead of User
    • LocalFile::deleteOldFile() - now accepts UserIdentity instead of User
  • The following global methods, each deprecated since 1.36, have been removed:
    • wfAppendToArrayIfNotDefault()
    • wfAcceptToPrefs()
    • wfConfiguredReadOnlyReason()
    • wfDebugMem()
    • wfGetPrecompiledData()
    • wfNegotiateType()
  • The following deprecated methods of the Title class have been removed:
    • ::nameOf(), deprecated in 1.36
    • ::getPreviousRevisionID(), deprecated in 1.34
    • ::getNextRevisionID(), deprecated in 1.34
    • ::getEarliestRevTime(), deprecated in 1.35
  • UploadBase::stashFile(), deprecated since 1.28, was removed.
  • wfGetRusage(), deprecated since 1.35, has been removed.
  • The following CLI options were removed from tests/phpunit.php:
    • use-filebackend
    • use-jobqueue
    • use-bagostuff
  • The following options (inherited from Maintenance) were also removed:
    • conf
    • dbuser
    • dbpass
    • dbdefaultgroup
    • globals
    • memory-limit
    • profiler
    • server
  • The following options were changed to environment variables:
    • wiki => PHPUNIT_WIKI
    • use-normal-tables => PHPUNIT_USE_NORMAL_TABLES
    • use-filebackend => PHPUNIT_USE_FILEBACKEND
    • use-bagostuff => PHPUNIT_USE_BAGOSTUFF
    • use-jobqueue => PHPUNIT_USE_JOBQUEUE
  • This is so that we can use the default PHPUnit entry point (task T90875).
  • The PHPUNIT_REUSE_DB / --reuse-db option was removed from the phpunit.php runner. It had been broken for at least three years already. The original use case was speeding up tests on Oracle, but Oracle support was dropped several releases ago.
  • The MediaWikiPHPUnitTest__endTestHook and MediaWikiPHPUnitTest__startTestHook PHPUnit hooks were removed. MediaWikiHooksPHPUnitExtension was also removed.
  • EntryPoint::getTextFormatters() was made private without a deprecation period; it had no known external callers.
  • DatabaseBlock::chooseBlock(), deprecated since 1.35, was removed.
  • SpecialPageFactory::getRestrictedPages(), deprecated since 1.36, was removed.
  • SpecialBlock::validateTarget(), deprecated since 1.36, was removed.
  • The PatchFileLocation trait was removed without deprecation.
  • ActorMigrationBase::getExistingActorId() and ::getNewActorId(), emitting deprecation warnings since 1.36, were removed.
  • Hook handlers implementing the MediaWikiServicesHook hook are now prohibited from having services injected. This is because by definition, this hook runs before the service container is fully initialized.
  • The protected property LocalFile::$metadata was removed without deprecation.
  • WatchedItem::getUser(), emitting deprecation warnings since 1.36, has been removed.
  • AuthManager::singleton(), emitting deprecation warnings since 1.36, has been removed.
  • The AugmentPageProps class was removed without deprecation. It had no known uses.
  • Html::infobox(), deprecated since 1.36, was removed.
  • ParserOptions::__construct() now requires that the first parameter is a UserIdentity object - passing `null` used to fallback to the global $wgUser but was deprecated since 1.36.
  • ParserOptions::newCanonical() no longer supports the first parameter being null (or omitted entirely), which would fallback to the global $wgUser but was deprecated since 1.35.
  • The SkinTemplatePreventOtherActiveTabs hook, deprecated in 1.35, was removed entirely.
  • The SkinTemplateTabAction hook, deprecated in 1.35, was removed entirely.
  • The SkinTemplateBuildNavUrlsNav_urlsAfterPermalink hook, deprecated in 1.35, was removed entirely.
  • The SkinTemplateToolboxEndHook, deprecated in 1.35, was removed entirely.
  • The following methods of the RevisionStore class, formerly emitting deprecation warnings, were removed:
    • ::newMutableRevisionFromArray()
    • ::loadRevisionFromPageId()
    • ::loadRevisionFromTitle()
    • ::loadRevisionFromTimestamp()
    • ::listRevisionSizes()
  • LogEntry::getPerformer(), deprecated since 1.36, was removed along with methods in sub-classes: DatabaseLogEntry, ManualLogEntry, RCDatabaseLogEntry.
  • Skin::getRelevantUser() now returns an instance of UserIdentity, and not necessarily a User object. There were no known usages in the MediaWiki ecosystem that were not satisfied with UserIdentity.
  • Direct construction of the MergeHistory class, deprecated since 1.35, is no longer supported. Use MergeHistoryFactory instead. MergeHistory::checkPermissions, deprecated since 1.36, was removed.
  • Skin::generateDebugHTML(), deprecated since 1.35, was removed. Call MWDebug::getHTMLDebugLog() directly.
  • The ApiTestCase class no longer interacts with the global $wgUser. Previously, the global variable was set at the start of each test, and in ApiTestCase::doApiRequest() if a performer was specified $wgUser was updated to match, and if no performer was specified $wgUser was used instead. Now, $wgUser is not updated, and if no performer is specified the reusable TestUser object for the sysop is relied on. Extensions or skins that rely on the global $wgUser variable (which has been deprecated since 1.35) should instead retrieve the acting user from the relevant context source.
  • SkinTemplate::makeArticleUrlDetails(), deprecated since 1.35, was removed.
  • Skin::makeNSUrl(), deprecated since 1.35, was removed.
  • Skin::getRevisionId(), deprecated since 1.34, was removed. Use OutputPage::getRevisionId() instead.
  • Skin::isRevisionCurrent(), deprecated since 1.34, was removed. Use OutputPage::isRevisionCurrent() instead.
  • AbstractBlock::parseTarget(), deprecated since 1.36, was removed.
  • The ArticleEditUpdates hook, deprecated since 1.35, was removed.
  • The `@stable to extend` class CentralIdLookup has received the following changes:
    • The protected ::checkAudience() method now returns an Authority instead of a User instance.
    • A number of its `@stable to override` methods now accept an Authority instead of a User instance as the $audience parameter.
    • A number of methods now accept a UserIdentity instead of their User parameter.
    • The ::localUserFromCentralId() method now returns UserIdentity and not necessarily a User object.
  • All extensions that extend this class or use this method were updated to be ready to the new behavior.
  • WatchedItemStoreInterface::enqueueWatchlistExpiryJob(), deprecated since 1.36, was removed.
  • ResultWrapper is now abstract. It cannot be directly constructed (task T286694).
  • The SecondaryDataUpdates hook, deprecated in 1.32, was removed entirely.
  • Content::getDeletionUpdates(), was removed. Use ContentHandler::getDeletionUpdates() instead.
  • Content::getSecondaryDataUpdates(), was removed. Use ContentHandler::getSecondaryDataUpdates() instead.
  • wfDiff(), deprecated since 1.25, has been removed.
  • Language::$mLangObjCache, deprecated since 1.35, was removed.
  • Language::$transformData, deprecated since 1.35, was removed.
  • Language::transformUsingPairFile() was marked as @internal. Its deprecated parameters are no longer supported.
  • SpecialMute::getTarget(), unused outside of the SpecialMute class, was made private.
  • The Skin::setupSkinUserCss() method, deprecated in 1.32, was removed. Please use skin registration instead.
  • The ResourceLoaderSkinModule `legacy`, `content` and `content-thumbnails` features were deprecated. Skins should instead select from the features listed on mw:Manual:ResourceLoaderSkinModule.
  • ParserCache::getKey() and ::getEtag(), deprecated since 1.36, were removed.
  • The BaseTemplateToolbox hook, deprecated since 1.35, was removed.
  • Previously a capitalize-all-nouns class was added to the body element of languages where nouns must be capitalized. This class is no longer added to the body tag and must be provided by skins.
  • The SkinTemplateOutputPageBeforeExec hook, deprecated since 1.35, was removed.
  • Calling Message::toString() without a parameter, which triggered deprecation warnings since 1.36, is no longer supported. You can instead use the explicit formatting methods directly, such as Message::text() and Message::escaped().
  • Article::getContentObject(), deprecated since 1.32, was removed.
  • Article::delete(), Article::confirmDelete() and ImagePage::delete() were removed. The logic responsible for building the form is being moved to DeleteAction, while the actual deletion logic will be moved to a separate service.
  • WikiImporter::debugRevisionHandler(), unused and for debug only, was removed.
  • Content::preloadTransform() now emits deprecation warnings. Instead, please use ContentTransformer::preloadTransform(). Extensions defining a content model should override ContentHandler::preloadTransform().
  • Content::preSaveTransform() now emits deprecation warnings. Instead, please use ContentTransformer::preSaveTransform() instead. Extensions defining a content model should override ContentHandler::preSaveTransform().
  • Constructing WikiPage objects from Title instances that cannot exist, emitting deprecation warnings since 1.36, now throws an exception. Additionally, WikiPage now implements ProperPageIdentity, rather than just PageIdentity.
  • The Skin::bottomScripts() method is deprecated. Please instead use OutputPage::getBottomScripts().
  • LinksUpdate::getTriggeringUser() now returns ?UserIdentity instead of ?User.
  • The LESS mixin `.box-shadow()` (from mediawiki.mixins.less), deprecated since 1.36, was removed. Use CSS property `box-shadow` unprefixed for all basic supported browsers instead.
  • The LESS mixin `.flex()` now no longer tries to support the 2009 version of the Flexbox specification; support for the 2012 and modern standard versions remains unchanged.
  • The StorageAwareness::ATTR_SYNCWRITES, StorageAwareness::QOS_SYNCWRITES_*, StorageAwareness::ATTR_LOCALITY, and StorageAwareness::QOS_LOCALITY_* constants were removed.

Deprecations in 1.37 edit

  • JobQueue::getWiki(), deprecated in 1.33, now emits deprecation warnings.
  • AbstractBlock::getTargetAndType() and ::getTarget() now emit deprecation warnings. Use ::getTargetName() and ::getTargetUserIdentity() together with ::getType().
  • Passing a UserIdentity to WatchlistManager::clearAllUserNotifications() and WatchlistManager::clearTitleUserNotifications() is now deprecated. Pass an Authority instead.
  • Passing LinkTarget to WatchlistManager::clearTitleUserNotifications() and WatchlistManager::getTitleNotificationTimestamp(). Pass PageIdentity instead.
  • The User class methods ::isWatched(), ::isTempWatched(), ::removeWatch(), and ::addWatch() have been deprecated. Use corresponding methods in WatchlistManager instead.
  • Multiple WatchAction methods have been deprecated in lieu of WatchlistManager:
    • ::doWatchOrUnwatch() use WatchlistManager::setWatch()
    • ::doWatch() -> WatchlistManager::addWatch()
    • ::doUnwatch() -> WatchlistManager::removeWatch()
  • WatchAction::getWatchToken() now emits deprecation warnings. Instead use CsrfTokenSet::getToken().
  • Action::getHookContainer() has been marked as internal. Actions that require access to a hook container should have one injected instead.
  • The ::getTitle() and ::setTitle() methods in Parser have been deprecated. Use ::getPage() and ::setPage() instead.
  • Title::isWatchable() has been deprecated. Use WatchlistManager::isWatchable() instead.
  • Methods and classes related to the primary database, previously referred to as 'master', have been deprecated, with the new ones replacing them as follows:
    • The DBMasterPos and MySQLMasterPos classes have been respectively renamed to DBPrimaryPos and MySQLPrimaryPos.
    • LocalRepo::getMasterDB() -> ::getPrimaryDB()
    • ForeignDBRepo::getMasterDB() -> ::getPrimaryDB()
    • JobQueueDB::getMasterDB() -> ::getPrimaryDB()
    • ForeignDBViaLBRepo::getMasterDB() -> ::getPrimaryDB()
    • DBFileJournal::getMasterDB() -> ::getPrimaryDB()
    • ILoadBalancer::getMasterPos() -> ::getPrimaryPos()
    • IDatabase::getMasterPos() -> ::getPrimaryPos()
    • ILoadBalancer::finalizeMasterChanges() -> ::finalizePrimaryChanges()
    • ILoadBalancer::approveMasterChanges() -> ::approvePrimaryChanges()
    • ILoadBalancer::beginMasterChanges() -> ::beginPrimaryChanges()
    • ILBFactory::beginMasterChanges() -> ::beginPrimaryChanges()
    • ILoadBalancer::commitMasterChanges() -> ::commitPrimaryChanges()
    • ILBFactory::commitMasterChanges() -> ::commitPrimaryChanges()
    • IDatabase::getTopologyRootMaster() -> ::getTopologyRootPrimary()
    • IDatabase::masterPosWait() -> ::primaryPosWait()
    • ILoadBalancer::runMasterTransactionIdleCallbacks() -> ::runPrimaryTransactionIdleCallbacks()
    • ILoadBalancer::runMasterTransactionListenerCallbacks() -> ::runPrimaryTransactionListenerCallbacks()
    • ILoadBalancer::rollbackMasterChanges() -> ::rollbackPrimaryChanges()
    • ILBFactory::rollbackMasterChanges() -> ::rollbackPrimaryChanges()
    • ILoadBalancer::flushMasterSnapshots() -> ::flushPrimarySnapshots()
    • ILoadBalancer::hasMasterConnection() -> ::hasPrimaryConnection()
    • ILoadBalancer::hasMasterChanges() -> ::hasPrimaryChanges()
    • ILBFactory::hasMasterChanges() -> ::hasPrimaryChanges()
    • ILoadBalancer::lastMasterChangeTimestamp() -> ::lastPrimaryChangeTimestamp()
    • ILoadBalancer::hasOrMadeRecentMasterChanges() -> ::hasOrMadeRecentPrimaryChanges()
    • ILBFactory::hasOrMadeRecentMasterChanges() -> ::hasOrMadeRecentPrimaryChanges()
    • ILoadBalancer::pendingMasterChangeCallers() -> ::pendingPrimaryChangeCallers()
    • ILoadBalancer::forEachOpenMasterConnection() -> ::forEachOpenPrimaryConnection()
    • ILoadBalancer::waitForMasterPos() -> ::waitForPrimaryPos()
    • Database::assertIsWritableMaster() -> ::assertIsWritablePrimary()
    • RevDelList::reloadFromMaster() -> ::reloadFromPrimary()
    • ExternalStoreDB::getMaster() -> ::getPrimary()
    • DatabaseMysqlBase::getMasterServerInfo() -> ::getPrimaryServerInfo()
    • MWExceptionHandler::rollbackMasterChangesAndLog() -> ::rollbackPrimaryChangesAndLog()
  • wfGetLB(), deprecated since 1.27, now emits deprecation warnings.
  • wfLocalFile(), deprecated since 1.34, now emits deprecation warnings.
  • wfFindFile(), deprecated since 1.34, now emits deprecation warnings.
  • wfIncrStats(), deprecated in 1.36, now emits deprecation warnings.
  • wfCanIPUseHTTPS() is now deprecated, and always returns true.
  • The UserLoadFromDatabase hook has been deprecated. It had no known uses.
  • The following methods in ApiPageSet have been deprecated:
    • ::getTitles(), use ::getTargets() instead.
    • ::getGoodTitles(), use ::getGoodPages() instead.
    • ::getMissingTitles(), use ::getMissingPages() instead.
    • ::getGoodAndMissingTitles(), use ::getGoodAndMissingPages() instead.
    • ::getRedirectTitles(), use ::getRedirectTargets() instead.
    • ::getSpecialTitles(), use ::getSpecialPages() instead.
  • The following methods from the User class, deprecated in 1.35, now each emit deprecation warnings:
    • ::getOptions()
    • ::isIP()
    • ::isUsableName()
    • ::isCreatableName()
    • ::getCanonicalName()
    • ::addAutopromoteOnceGroups()
    • ::getEffectiveGroups()
    • ::getAutomaticGroups()
    • ::getFormerGroups()
    • ::getIntOption()
    • ::getBoolOption()
  • The following methods in User were deprecated:
    • ::idFromName() - use UserIdentityLookup::getUserIdentityByName() instead.
    • ::resetIdByNameCache() - in tests, reset service container. No replacement needed in production code.
  • Use of ActorMigration for any table except revision, deprecated in 1.34, now emits deprecation warnings. Instead of getInsertValues(), use ActorNormalization::acquireActorId(). Instead of getWhere() and getJoin(), do your own join on the actor table.
  • DatabasePostgres::remappedTableName() and its dependent constructor parameter 'keywordTableMap' are deprecated. Reserved identifiers that are used as table names should be quoted where necessary.
  • LinkCache::singleton(), deprecated since 1.28, now emits deprecation warnings.
  • MessageCache::singleton(), deprecated since 1.34, now emits deprecation warnings.
  • LockManagerGroup::singleton() and ::destroySingletons(), deprecated since 1.34, now emit deprecation warnings.
  • HtmlFileCacheUpdate::newFromTitles() is now deprecated and emitting warnings. Use newFromPages() instead.
  • SessionProvider ::setLogger(), ::setManager(), ::setConfig(), and ::setHookContainer() were deprecated. Use ::init() to inject dependencies, or override ::postInitSetup() to do any custom post-initialization configuration.
  • AbstractAuthenticationProvider ::setLogger(), ::setManager(), ::setConfig(), and ::setHookContainer() now emit deprecation warnings. Use ::init() to inject dependencies, or override ::postInitSetup() to do any custom post-initialization configuration.
  • User::isLoggedIn(), deprecated since 1.36, now emits deprecation warnings. Use the method it wraps, User::isRegistered(), instead.
  • FileBackendGroup::singleton() and ::destroySingletons(), deprecated since 1.35, now emit deprecation warnings.
  • The first parameter of User::getBlock() should now be an integer using the Authority::FOR_XXX constants. Providing a boolean is deprecated.
  • ApiBase::addBlockInfoToStatus() is deprecated for use by extensions. It is now marked as @internal and may be deleted in the future. It should not be necessary to call this method, Authority should be providing all relevant information via a PermissionStatus object.
  • JobQueueGroup::singleton() was deprecated - use MediaWikiServices::getJobQueueGroup() instead.
  • JobQueueGroup::destroySingletons() was deprecated. JobQueueGroups are now automatically destroyed after tests.
  • LinkCache::addGoodLinkObj() has been deprecated, since it is prone to corrupting the cache with invalid information. Use addGoodLinkObjFromRow() instead. PHPUnit tests must use LinkCacheTestTrait::addGoodLinkObject().
  • ContentHandler::getContentText() is now deprecated. Use Content::getText() instead.
  • LinkCache::addLinkObj() has been deprecated, use PageStore::getPageForLink() instead.
  • MediaWiki\User\UserNamePrefixSearch::search() previously accepted as its first parameter either the string 'public' or a UserIdentity object, to filter results for. It now expects an Authority object instead of UserIdentity, and providing just a UserIdentity will now trigger a deprecation warning.
  • User::getRights(), deprecated since 1.34, now emits deprecation warnings.
  • User::changeableGroups() and ::changeableByGroup() now emit deprecation warnings. Use corresponding methods in UserGroupManager instead.
  • User::incEditCount() was deprecated in favor of the new method UserEditTracker::incrementUserEditCount().
  • RepoGroup::singleton(), ::destroySingleton() and ::setSingleton(), deprecated since 1.34, now emit deprecation warnings.
  • RecentChange::getPerformer(), deprecated since 1.36, now emits deprecation warnings. Use ::getPerformerIdentity() instead.
  • ContentHandler::cleanupHandlersCache(), deprecated since 1.35, now emits deprecation warnings.
  • Category::getTitle() was deprecated in favor of Category::getPage()
  • File::getUser() method now emits deprecation warnings, along with its overrides in LocalFile and ForeignApiFile in favor of ::getUploader().
  • SpecialBlock::checkUnblockSelf(), deprecated in 1.36, now emits deprecation warnings.
  • (task T284179) The mediawiki.viewport ResourceLoader module is deprecated. You can now just use MutationObserver or InterSectionObserver directly, which are widely available in all supported JavaScript browsers.
  • The following constructor options of DatabaseBlock class will now trigger deprecation warnings:
    • the 'byText' property with blocker's name,
    • the 'by' property with blocker's ID, For both of these, use the 'by' property with UserIdentity value instead.
  • The BeforeResetNotificationTimestamp hook was deprecated.
  • ArchivedFile::getUser() ::getRawUser() ::getRawUserText() were deprecated in favor of ::getUploader.() ::getRawDescription() was deprecated in favor of ::getDescription() with RAW audience parameter.
  • When calling LocalFile::newFromRow() or LocalFile::loadFromRow(), passing extra fields not requested by ::getQueryInfo() will now trigger deprecation warnings. This is to warn callers that deprefixing and automatic assignment of such fields will not be done in a future version.
  • JobSpecification::getTitle() was deprecated without providing a replacement. It wasn't used and job given the purpose of JobSpecification class it is not needed.
  • The protected method File::getImageSize() is now deprecated.
  • BacklinkCache::get() was deprecated, use BacklinkCacheFactory::getBacklinkCache() instead.
  • Title::getBacklinkCache() now emits deprecation warnings. Instead, use the ::getBacklinkCache() method in the BacklinkCacheFactory service.
  • MediaHandler::getImageSize(), ::getMetadata(), and ::isMetadataValid() were deprecated and should no longer be overridden. Instead, sub-classes should override getSizeAndMetadata().
  • Deprecated File::getMetadata(). Instead use ::getMetadataArray(), ::getMetadataItem() and ::getMetadataItems().
  • Message::title() has been deprecated; use Message::page() instead.
  • BaseTemplate::getAfterPortlet(), BaseTemplate::renderAfterPortlet(), and the BaseTemplateAfterPortlet hook, which were deprecated in 1.35, now emit deprecation warnings.
  • The LocalFile::getHistory() hook is deprecated.
  • Calling WikiPage::prepareContentForEdit() without a UserIdentity is now deprecated.
  • User::getEditTokenObject(), ::getEditToken(), and ::matchEditToken() were each deprecated. Use CsrfTokenRepository, which is available via IContextSource, instead. ::matchEditTokenNoSuffix() was deprecated without replacement. It was introduced to be able to provide custom error message if the token was submitted, but ending slashes were stripped by some ASCII mangling proxy. Use ::matchToken() instead, such proxies are much less common now and there's not much benefit in customising the error message.
  • ContentHandler::getForTitle(), deprecated since 1.35, now emits deprecation warnings.
  • User::listOptionKinds(), deprecated since 1.35, now emits deprecation warnings.
  • WikiPage::doEditContent(), deprecated since 1.32, now emits deprecation warnings.
  • CentralIdLookup::factory() and ::factoryNonLocal() now emit deprecation warnings; obtain an instance from MediaWikiServices instead.
  • The class RandomPage was renamed to SpecialRandomPage. The class RandomPage is now deprecated.
  • BotPassword::invalidateAllPasswordsForCentralId() was deprecated.
  • BotPassword::removeAllPasswordsForCentralId() was deprecated.
  • The Title class members: $mTextform, $mUrlform, $mDbkeyform, $mNamespace, $mInterwiki, and $mFragment have been deprecated to not be used directly. Instead, their corresponding accessor methods should be used.
  • IDatabase::fetchObject(), ::fetchRow(), ::numRows(), ::numFields(), ::fieldName(), ::freeResult() and ::dataSeek() are deprecated. Use the corresponding methods in IResultWrapper instead.
  • ResultWrapper::unwrap(), DatabaseMysqlBase::fieldType() and DatabasePostgres::fieldType() each now emit deprecation warnings.
  • Sub-classes implementing Database::doQuery() should return either boolean or an IResultWrapper. To do otherwise will now trigger a deprecation warning.
  • User::getOptionKinds() and ::resetOptions(), both deprecated since 1.35, now emit deprecation warnings.
  • The following methods in MWNamespace, all deprecated since 1.34, now emit deprecation warnings:
    • ::isMovable()
    • ::isSubject()
    • ::getTalk()
    • ::getSubject()
    • ::getAssociated()
    • ::equals()
    • ::subjectEquals()
    • ::hasTalkNamespace()
    • ::wantSignatures()
    • ::isWatchable()
    • ::getSubjectNamespaces()
    • ::getTalkNamespaces()
    • ::isCapitalized()
    • ::hasGenderDistinction()
    • ::isNonincludable()
    • ::getNamespaceContentModel()
    • ::getRestrictionLevels()
    • ::getCategoryLinkType()
  • LogFormatter::styleRestricedElement() has been deprecated in favor of LogFormatter::styleRestrictedElement()
  • The following hooks related to user preferences were deprecated:
    • UserLoadOptions: use LoadUserOptions instead.
    • UserSaveOptions: use SaveUserOptions instead.
    • UserResetAllOptions: no replacement was provided, the hook is not used.
  • Title::isNamespaceProtected(), deprecated in 1.34, now emits deprecation warnings.
  • UserSelectQueryBuilder::userIds(), ::userNames(), and ::userNamePrefix() has been deprecated in favor of ::whereUserIds(), ::whereUserNames(), and ::whereUserNamePrefix().
  • Manually constructing a MovePage object, deprecated in 1.34, now emits deprecation warnings. Use MovePageFactory instead.
  • The following deletion-related methods were deprecated:
    • WikiPage::doDeleteArticleReal() (soft) - use DeletePage
    • WikiPage::doDeleteArticleBatched() (soft) - no replacement
    • WikiPage::isBatchedDelete() (soft) - use DeletePage
    • WikiPage::doDeleteUpdates() (hard) - no replacement
    • WikiPage::getDeletionUpdates() (hard) - no replacement
    • Title::isBigDeletion (soft) - no replacement
  • Relying on PermissionManager or Authority to check for big deletions was deprecated. This is now automatically checked if you use DeletePage::deleteIfAllowed(). (task T288759)
  • The userCan hook now emits deprecation warnings. Use the getUserPermissionsErrors or getUserPermissionsErrorsExpensive hooks instead.
  • Parser::$mUser public access, and the methods ParserOptions::getUser() and Parser::getUser() each now emit deprecation warnings.
  • The following methods in the Title class have been deprecated in favor of the corresponding methods in the new RestrictionStore service (with different names where indicated):
    • ::areCascadeProtectionSourcesLoaded()
    • ::areRestrictionsCascading()
    • ::areRestrictionsLoaded()
    • ::getAllRestrictions()
    • ::getCascadeProtectionSources()
    • ::getFilteredRestrictionTypes() -> ::listAllRestrictionTypes()
    • ::getRestrictionExpiry()
    • ::getRestrictionTypes() -> ::listApplicableRestrictionTypes()
    • ::getRestrictions()
    • ::isCascadeProtected()
    • ::isProtected()
    • ::isSemiProtected()
    • ::loadRestrictionsFromRows()
  • The following Title methods have been deprecated with no direct public replacement:
    • ::deleteTitleProtection()
    • ::getTitleProtection()
    • ::flushRestrictions()
    • ::loadRestrictions()
  • User::isAllowUsertalk() now emits deprecation warnings. Use User::getBlock() and AbstractBlock::isUsertalkEditAllowed() instead.
  • Classes used by Preprocessor_DOM have been merged with classes used by Preprocessor_Hash, as Preprocessor_DOM was removed in 1.35.
    • PPDPart has been merged into PPDPart_Hash
    • PPDStack has been merged into PPDStack_Hash
    • PPDStackElement has been merged into PPDStackElement_Hash
  • By default, the global variable $wgUser is now an instance of the new class StubGlobalUser rather than User, and the first time it is used it will emit deprecation warnings (the $wgUser variable was deprecated in 1.35). For extensions that read from this variable, please use a relevant ContextSource instead, falling back to RequestContext::getMain() if none is available.
  • Collation::singleton() and ::factory() were deprecated; obtain an instance of the CollationFactory from MediaWikiServices instead.
  • Title::getDefaultNamespace() has been deprecated to be removed because there are no known callers/consumers.
  • With removal of the stub threshold feature, the following methods now emit deprecation warnings:
    • LinkRenderer::setStubThreshold() and ::getStubThreshold() - no replacement.
    • LinkRendererFactory::createForUser() - calling ::create() is now sufficient
    • ParserOptions::setStubThreshold() and ::getStubThreshold() - no replacement.
    • User::getStubThreshold() - no replacement.
  • The ArticleDelete and ArticleDeleteComplete hooks were deprecated. Use PageDelete and PageDeleteComplete instead.
  • The ArticleUndeleteLogEntry hook was deprecated without replacement.
  • The following LESS mediawiki.mixins have been deprecated:
    • .box-sizing()
    • .transform()
    • .transform-origin()
    • .transition()
    • .transition-transform()
  • The `UndeleteForm::undelete` hook was deprecated. A new hook was introduced, `PageUndelete`, that provides handlers with more information and is also called for non-UI requests. The capability of replacing the PageArchive object has been removed, as that violates the laws of nature.

Other changes in 1.37 edit

  • WatchlistManager::addWatch() and WatchlistManager::addWatchIgnoringRights(), which replace User::addWatch(), now call the WatchArticle and WatchArticleComplete hooks.
  • WatchlistManager::removeWatch() and WatchlistManager::removeWatchIgnoringRights(), which replace User::removeWatch(), now call the UnwatchArticle and UnwatchArticleComplete hooks.
  • The overridable postInitSetup() method was added to the AbstractAuthenticationProvider class. A provider can override postInitSetup() to do any custom post-initialization configuration.
  • The overridable postInitSetup() method was added to the SessionProvider class. A provider can override postInitSetup() to do any custom post-initialization configuration.
  • The protected getConfig() method was added to the SessionProvider class. Use SessionProvider::getConfig() to get a config.
  • The DBAccessBase class is deprecated. Classes that used to extend it should get a load balancer (factory) injected in the constructor instead.
  • ActorNormalization::acquireActorId() now requires IDatabase parameter. Not providing one emitted deprecation warnings since 1.36.
  • Anti-lock constants ALF_PRELOAD_LINK, ALF_NO_BLOCK_LOCK, ALF_NO_LINK_LOCK and ALF_PRELOAD_EXISTENCE have been removed. They're unused since 1.25.
  • (task T278036) CSS class 'mw-htmlform-field-autoinfuse' used by some forms has been renamed to 'mw-htmlform-autoinfuse'.
  • User::newFromRow() does not accept pre-loaded user preferences under $data['user_properties'] anymore. This optimization was not used.
  • The following files change the letter case of the file names:
    • SpecialRandompage.php -> SpecialRandomPage.php
    • SpecialRandomredirect.php -> SpecialRandomRedirect.php
    • SpecialRandomrootpage.php -> SpecialRandomRootPage.php
  • Media files which are uploaded server side using the importImages.php maintenance script will now have the "mw-server-side-upload" change tag.
  • (task T284917) The stub threshold feature has been removed.
  • Skin::getPoweredBy() and Skin::getCopyrightIcon() have been deprecated as they are only designed for use by skins extended BaseTemplate. You can move calls to instead use BaseTemplate::getPoweredByHTML() and ::getCopyrightIconHTML() respectively.
  • The SkinGetPoweredBy hook is deprecated. No replacement is provided.
  • HTMLTitleTextField didn't support interwiki titles well previously. Starting with 1.37, HTMLTitleTextField has a new parameter, 'interwiki', which can be used to control acceptance of interwiki titles. To provide a transitional period, the default value ('interwiki' => null) ensures MW will have the same behavior as before (logging a deprecation warning). In 1.38, the default behavior will change to "interwiki links aren't allowed".

Compatibility edit

MediaWiki 1.37 requires PHP 7.3.19 or later and the following PHP extensions:

  • ctype
  • dom
  • fileinfo
  • iconv
  • intl
  • json
  • mbstring
  • xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used, but support for them is somewhat less mature.

The supported versions are:

  • MySQL 5.5.8 or later
  • PostgreSQL 9.4 or later
  • SQLite 3.8.0 or later

Online documentation edit

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list edit

A mailing list is available for MediaWiki user support and discussion:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help edit

There's usually someone online in #mediawiki on irc.libera.chat.

MediaWiki 1.38 edit

MediaWiki 1.38.7 edit

This is a security and maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.6 edit

MediaWiki 1.38.6 edit

This is a security and maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.5 edit

  • Localisation updates.
  • (task T325872) ChangeTags: Remove table name from condition.
  • (task T324895) MWCallbackStream: Add explicit $stream property.
  • (task T297031, task T326039) PostgresUpdater: Move setDefault ahead of changeNullableField.
  • Remove /images .htaccess rules that are no longer relevent.
  • Disable php in .htaccess of images directory as a hardening measure.
  • (task T322583) Include missing message parameter in message.
  • Fix phan error when Excimer is enabled.
  • (task T323373) Parser: Fix extractSections() behavior for PHP >= 8.0
  • (task T326021) Add matrix: to $wgUrlProtocols.
  • (task T326377) rdbms: Use DBConnRef in SelectQueryBuilder.
  • api/en.json: api-help-datatype-expiry add missing 'may'.
  • (task T328222) Pass empty string to strlen() if schema is null for PostgresDatabase.
  • (task T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
  • (task T289926) SpecialRevisionDelete: Set default of for wpReason.
  • (task T155582, task T328503) Fix XML dumps for content types with non-string getNativeData().
  • (task T314099) revisiondelete: Replace dynamic property Status::$itemStatuses.
  • (task T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
  • (task T292348) WikiImporter: do not fail if upload entry in dump lacks 'text' tag.
  • (task T295637) Add no to fallback chain of nb and nn.
  • (task T329484) API: Fix query+allimages user parameter description.
  • (task T330529) SpecialEditTags: Set default of for wpReason.
  • (task T330526) htmlform: Handle null from HTMLFormField::getDefault in multiselects.
  • (task T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted XFF headers.

MediaWiki 1.38.5 edit

This is a security and maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.4 edit

  • Localisation updates.
  • Tests: Explicit cast to int in RandomImageGenerator test (php8 warnings).
  • (task T319000) WebInstaller: Don't try and run trim() on null.
  • (task T318753) Installer: Disable logo dropper for now.
  • (task T320864) When calling mail(), use an array for headers.
  • (task T311567) In ManualLogEntry, cast the comment to string.
  • (task T289926) api: Fix minor PHP 8.1 incompatibility in ApiOptions.
  • (task T322803) SpecialBotPasswords: Don't pass null to trim().
  • (task T323082) Upgrading wikimedia/xmp-reader (0.8.1 => 0.8.5).
  • Language: Handle ronna and quetta.
  • PostgresUpdater: Remove trailing space from 'user_id ' column.
  • (task T304515) LCStoreStaticArray: atomically replace the cache file.
  • (task T324890, task T324891, task T324901) Parser: Allow dynamic properties on PHP 8.2.
  • (task T324910) On pages using multi-content revisions, the raw content of a specific slot can be retrieved using the action=raw&slot=<role-name> query parameters.
  • (task T322637) SECURITY: sqlite should not create DB file world-readable.

MediaWiki 1.38.4 edit

This is a maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.3 edit

  • Fix missing use statement from backport of fix for task T307278.

MediaWiki 1.38.3 edit

This is a security and maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.2 edit

  • Localisation updates.
  • (task T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
  • (task T311559) SpecialListFiles: user parameter isn't always present.
  • (task T311561) ImageListPager: Don't call htmlspecialchars() on null.
  • (task T311920) SpecialBlockList: Prevent passing null to trim().
  • (task T311921) SpecialUserrights: Don't pass null to str_replace.
  • (task T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize().
  • (task T311574, task T311576) SpecialLinkSearch: Don't pass null through to the parser.
  • (task T311360) RecentChange: Straight join to actor table when needed.
  • (task T311360) RecentChange: Make join to comment table also straight.
  • Remove messages in en-gb.json.
  • (task T312519, task T312520) Parser::extensionSubstitution() Don't run substr() on null.
  • (task T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
  • (task T312302) SpecialRedirect: Don't pass null to explode.
  • RemoveInvalidEmails: Fix quoting for postgres.
  • (task T312678) import: UploadSourceAdapter::stream_read() don't pass null to strlen().
  • (task T312300) SpecialDiff: Don't pass null to explode().
  • (task T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
  • (task T289926) Handle null passed to wfShorthandToInteger() and Html::element().
  • (task T289926) Ensure that strlen() does not get passed a (valid) null.
  • (task T312301) SpecialDiff: Don't pass null to trim().
  • Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
  • (task T289926) Ensure we don't pass null to mb_strlen.
  • (task T312305, task T311572, task T311571, task T311578) HtmlForm: Null coalescence in trim() calls.
  • (task T289926) site: Consistently return null from Site::getDomain().
  • (task T307304, task T289879) filebackend,jobqueue: Add signature for FilterIterator::accept().
  • (task T304559) Use page ID from parent revision, improve logging.
  • (task T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
  • Add application/vnd.ms-opentype to MIME list.
  • Allow composer/installers plugin in composer.json.
  • (task T313663) Make ReadOnlyModeTest work in php8.
  • (task T313663) Make HandlerTestTrait compatible with php8.1.
  • (task T313663) [php8] Make DeletePageTest stop giving warnings on php8.1.
  • Change type hints for BatchRowIterator and NotRecursiveIterator for compatibility with PHP 8.1.
  • (task T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
  • (task T313663) parser: Mock WikiPage::getContentModel in ParserCacheTest to fix php8.1.
  • (task T313663) [php8.1] Make WikiImporterFactoryTest use better mock for ImportSource.
  • Fix tests so getName() doesn't return null.
  • (task T313663) [php8] Don't use strlen on potentially null string.
  • (task T313663) [php8.1] Suppress test warning about providing null.
  • (task T313663) [php8.1] mock User::getTitleKey() in DeaultPreferencesFactoryTest.
  • (task T313663) Parser will use current timestamp instead of null if passed a RevisionRecord that does not have a timestamp.
  • (task T313663) Add explicit null check for $sha in FileBackend [php8.1].
  • (task T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
  • (task T313663) Mock UserOptionsManager::getOption for php8.1.
  • (task T289879, task T289926) Get rid of warnings on PHP 8.1.
  • (task T313663) Check for null return of preg_replace in MediaWikiTitleCodec.
  • (task T313663) cast db name to string when checking if it is read only [php8.1].
  • (task T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
  • (task T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
  • (task T313663) Mock User::getTitleKey in SpecialPreferencesTest [php 8.1].
  • (task T314096) Migrate use of ${var}-style string interpolation.
  • (task T314099) preprocessor: Add missing field declarations.
  • (task T313663, task T313662) Make default value for optional args 0 be not null.
  • (task T313663) [php8.1] Mock out getLocalDomainID for WatchedItemStore tests.
  • (task T313663) Suppress warnings for the null test of addIdentifierQuotes.
  • (task T314225) SpecialCategories: Null coalescene $par.
  • (task T314099) User: Allow dynamic properties on PHP 8.2.
  • (task T314404) SpecialGoToInterwiki: Null coalescene $par.
  • (task T314397) SpecialBlock: Better handle null in getTargetUserTitle.
  • (task T314099) phpunit: Fix trivial dynamic property usages in tests.
  • (task T314405) UploadStash: Check if us_prop is set in the fileMetadata.
  • (task T313663) Make ChangesListSpecialPageTest cast to string for php 8.1.
  • (task T313663) Do not test giving a null fragment to Title::makeTitle.
  • (task T314550) SpecialMergeHistory: Set timestamp to if no mergepoint.
  • (task T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
  • (task T313663) Cast results of Sqlite test to string [php 8.1].
  • (task T314208) Set $wgServer for HttpRequestFactoryTest to prevent warnings on php8.1.
  • (task T314208, task T297082) phpunit: Fallback to global default user options.
  • (task T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
  • Fix a couple deprecation warnings in the installer under PHP 8.1.
  • api: Add rel=nofollow to help examples.
  • (task T307613) Validate length of user email on Special:ChangeEmail/Special:CreateAccount.
  • (task T314226) LoginSignupSpecialPage: Check if $value is a string before length.
  • (task T314824) tests: Update parser test after i18n change.
  • (task T313663, task T296083) context: Replace deprecated User::getOption.
  • (task T295958, task T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
  • (task T314906, task T314907) SpecialBlock: Set defaults for wpPageRestrictions and wpNamespaceRestrictions.
  • (task T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
  • (task T315892) composer.json: Pin phpunit to 8.5.28.
  • (task T313663) Do not compare byte-for-byte of serialized items in tests [php8.1].
  • objectcache: avoid php 8.1 argument type warnings in genericKeyFromComponents().
  • (task T317750) session: Fix broken SessionTest case due to PHPUnit dependency change.
  • ManualLogEntry: Don't pass null to trim() as PHP 8.1 whines.
  • (task T313663) Add a null check VueComponentParser to prevent php8.1 issues.
  • (task T313049) Bump wikimedia/parsoid to v0.15.1.
  • (task T318754) WebInstallerOptions::addPersonalizationOptions(): Close fieldset.
  • (task T318460) SpecialChangeEmail: Set default for returntoquery.
  • (task T318307) Update docs for HTMLFormField::validate() to permit all data types.
  • (task T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results in an IP range check on Special:Contributions.
  • (task T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence of hidden users.
  • (task T307278, CVE-2022-41766) SECURITY: On action=rollback the message "alreadyrolled" can leak revision deleted user name.

MediaWiki 1.38.2 edit

This is a security and maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.1 edit

  • Localisation updates.
  • (task T309426) Repair language selector for SVGs.
  • (task T310013) Fix default value for $wgShowEXIF and $wgUsePathInfo.
  • (task T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
  • (task T308473) SECURITY: Escape contributions-title msg for use within page title.
  • (task T311272) Call parent constructor of AddSite maintenance script first.
  • MediaWiki: Don't eagerly initialize action name.
  • (task T311384, CVE-2022-27776) Updated guzzlehttp/guzzle from 7.4.1 to 7.4.5.
  • (task T289926) Avoid passing null to trim() in SkinTemplate.
  • (task T289879) Address deprecations for PHP 8.1.
  • (task T311473) rollbackEdits: Pass user identity to RollbackPage.
  • Upgrade wikimedia/remex-html from 3.0.1 to 3.0.2.
  • (task T311551) ShellboxClientFactory::getUrl(): Check if $this->key is null.
  • (task T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
  • (task T311569) FileBackend::isStoragePath() Handle being passed null.
  • (task T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
  • (task T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
  • (task T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
  • Upgrade wikimedia/common-passwords from 0.3.0 to 0.4.0.

MediaWiki 1.38.1 edit

This is a maintenance release of the MediaWiki 1.38 branch.

Changes since MediaWiki 1.38.0 edit

  • (task T309860) Add justinrainbow/json-schema to vendor.
  • (task T309933) Drop PHP 7.2 support in MediaWiki 1.38; require 7.3.19.

MediaWiki 1.38.0 edit

Changes since MediaWiki 1.38.0-rc.1 edit

  • Localisation updates.
  • (task T309114) LocalFile::prerenderThumbnails: Limit the number of thumbnail jobs triggered.
  • (task T305779) phpunit: Support setting skin context in BundleSizeTest subclasses.
  • (task T309028) SECURITY: ApiEditPage: update title after redirects.
  • (task T308967) notifications: prevent log spam when invalid user object listed.
  • composer: Lock Parsoid version to specific 0.15.0 release.
  • (task T306362, task T308680) change-your-logo.svg: Resize to 135px square, re-crush, and manually minify.

MediaWiki 1.38.0-rc.1 edit

Changes since MediaWiki 1.38.0-rc.0 edit

  • Localisation updates.
  • (task T305028) Undeprecate EditPage::$textbox2.
  • (task T305635) LogActions is a map, not a list.
  • (task T306721) Add wikimedia/equivset to vendor; needed by bundled AbuseFilter.
  • (task T307284) Simplify TransactionManager::pendingWriteQueryDuration.
  • (task T307307) Add symfony/yaml to vendor.
  • Fix old_name in UserLogoutComplete hook.
  • REST: don't send stack trace in error responses.
  • (task T307998) SessionManager: stop storing an ObjectFactory instance.
  • (task T193565) UserGroupManager: Fix dbDomain in addUserToGroup() deferred update.

Upgrading notes for 1.38 edit

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.29.

Some specific notes for MediaWiki 1.38 upgrades are below:

  • (task T191740) The AbuseFilter extension is now bundled with MediaWiki. This is an anti-abuse feature that lets privileged users to set specific actions to be taken when actions by users, such as edits or file uploads, match certain criteria.
  • (task T232948) The Math extension is now bundled with MediaWiki. This is a content feature that lets users create mathematical formulæ, written in a sub-set of LaTeX and rendered in MathML with a fallback SVG image. By default, it will use Wikimedia's mathoid service to render each formula, but local rendering can be set up for network isolation or performance.
  • (task T191743) The Minerva skin is now bundled with MediaWiki. This is a simple, light-weight, and scalable skin that is particularly optimised for mobile use, and integrates well with the MobileFrontend extension (available separately), but can also be used as a regular desktop skin.

For notes on 1.37.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.38 edit

New configuration edit

  • (task T297708) $wgMaxExecutionTimeForExpensiveQueries - This setting can be used to control the maximum execution time for several expensive query pages (e.g. RecentChanges and UserContribs).
  • $wgBrowserFormatDetection – This setting allows overriding browsers' automatic detection and handling of formats. It's initially used to prevent auto-linking of possible telephone numbers in wiki pages' output in Safari on iOS; this can be re-enabled if you wish, or locally extended for other browsers' quirks.
  • (task T240685) $wgMetricsTarget, $wgMetricsFormat, $wgMetricsPrefix - These provide configuration for a new MetricsFactory service with support for the dogstatsd format, intended for integration with Prometheus integration.
  • $wgGroupInheritsPermissions – This setting allows inheriting permissions, both granted and revoked, from another group.
  • $wgForeignApiRepos – ForeignAPIRepo now has a apiMetadataExpiry option to control for how long file metadata is cached. Additionally the default changed from 1 hour to 4 hours.
  • $wgSkinsPreferred – This lets you set a list of preferred skins to be listed higher in Special:Preferences.
  • $wgWikiFarmSettingsDirectory – A directory that contains site-specific configuration files. Setting this will enable multi-tenant ("wiki farm") mode, causing site-specific settings to be loaded based on information from the web request. EXPERIMENTAL.
  • $wgWikiFarmSettingsExtension – The file extension to be used when looking up site-specific settings files in $wgWikiFarmSettingsDirectory, such as 'json' or 'yaml'. EXPERIMENTAL.
  • $wgWikiFarmSiteDetector – A callback function that returns the name of the wiki for the current request. This is used in multi-tenant ("wiki farm") mode to determine which settings file to load from $wgWikiFarmSettingsDirectory. EXPERIMENTAL.
  • $wgEnableRemoteBagOStuffTests – This replaces the environment variable PHPUNIT_USE_BAGOSTUFF.
  • (task T230211) $wgForceDeferredUpdatesPreSend – Force deferred updates to be run before sending a response to the client, instead of attempting to run them after sending the response. Setting this to true is useful for end-to-end testing, to ensure that the effects of a request are visible to any subsequent requests, even if they are made immediately after the first one. Note however that this does not ensure that database replication is complete, nor does it execute any jobs enqueued for later.
  • $wgTemplateLinksSchemaMigrationStage – Templatelinks table schema migration stage, for normalizing tl_namespace and tl_title fields.

Changed configuration edit

  • $wgStyleDirectory and $wgExtensionDirectory – These are now set later, so can no longer be used within LocalSettings.php unless explicitly set in that file.
  • $wgFileBackends – This setting no longer takes 'fileJournal' as an option.
  • $wgMaxImageArea - This setting may now be set to false to disable size, checking before scaling. Extensions can still override its value by using the BitmapHandlerCheckImageArea hook.
  • $wgAjaxUploadDestCheck – This is now deprecated, and act as always-true.
  • $wgInterwikiCache – This no longer supports the string value for CDB files.
  • $wgParserOutputHooks – This is now deprecated; adjustments using this should be done with OutputPageParserOutputHook instead. (task T292321)
  • $wgExternalStores – This is newly documentated in includes/externalstore/README.md.

Removed configuration edit

  • $wgShellLocale - This setting has been removed as it was a flawed solution to the problem of locale dependence, MediaWiki will now always set a locale of C.UTF-8 or C and works around the remaining problems of the C locale by not using escapeshellarg. This follows the direction of PHP 8.0, which sets a locale of C by default instead of respecting LC_CTYPE.
  • $wgLoggedOutMaxAge - Experiment removed, originally added in 1.35. (task T293848)
  • $wgIncludejQueryMigrate - Deprecated in 1.36. We only support jQuery v3.
  • $wgUseCategoryBrowser - This experimental feature has been removed. If you still need to use this feature, please see mw:Extension:CategoryExplorer.
  • $wgStyleSheetPath - alias for $wgStylePath, deprecated since 1.3 (2004).

User-facing changes in 1.38 edit

  • (task T284921) The "auto-number headings" feature was removed following a consultation, due to performance reasons.

New operator/developer features in 1.38 edit

  • EXPERIMENTAL: The environment variable MW_CONFIG_FILE can be used to specify the location of the settings file. This allows alternative settings files to be loaded depending on the environment. Settings files may be given as PHP files like the traditional LocalSettings.php file, or they may use JSON or YAML format. See https://www.mediawiki.org/wiki/Manual:YAML_settings_file_format
  • Added a deleteUserEmail maintenance script - This file enables the deletion of a given user's associated email address. It can be helpful for privacy-preserving operations.
  • The description array for constructing an HTMLForm now can use 'disable-if' to disable fields on condition easily, supported expressions are the same as 'hide-if'.
  • There is a new interface, IForeignRepoWithMWApi, to allows you to mark file repos provided by an extension as supporting making API queries against the foreign file repo so that extensions like TimedMediaHandler that depend on this can stop hard-coding looking for specific class names.
  • Added EXPERIMENTAL support for an easy to configure multi-tenant ("wiki farm") mode:
    • Settings for each site can be placed in a directory specified by $wgWikiFarmSettingsDirectory. Site detection is controlled by $wgWikiFarmSiteDetector and defaults to the requested host name. For example, setting $wgWikiFarmSettingsDirectory = "sites" would cause the settings for wiki.example.com to be loaded from "sites/wiki_example_com.yaml". WARNING: YAML files under the web root may be accessible to browsers, please take appropriate measures to protect them from access via HTTP.
  • Running QUnit tests for an individual test suite module is possible with `grunt qunit --qunit-component={componentName}`, where {componentName} is "MediaWiki" to run core's QUnit tests or the skin or extension name.
  • The 'mediawiki.mixins' module now has a `.user-select()` Less mixin.

External library changes in 1.38 edit

New external libraries edit

  • symfony/yaml was promoted from development-only.

Changed external libraries edit

  • Updated OOUI from v0.42.0 to v0.43.2.
  • Updated Vue from 2.6.11 to 3.2.23.
  • Updated WVUI from v0.3.0 to v0.4.0.
  • Updated composer/semver from 3.2.5 to 3.2.6.
  • Updated guzzlehttp/guzzle from 7.2.0 to 7.4.1.
  • Updated pear/mail_mime from 1.10.9 to 1.10.11.
  • Updated pear/net_smtp from 1.9.2 to 1.10.0.
  • Updated psr/log from 1.1.3 to 1.1.4.
  • Updated psy/psysh from 0.10.5 to 0.11.1.
  • Updated symfony/polyfill-php80 from 1.23.1 to 1.25.0.
  • Updated wikimedia/assert from 0.5.0 to 0.5.1.
  • Updated wikimedia/cdb from 1.4.1 to 2.0.0.
  • Updated wikimedia/ip-utils from 3.0.2 to 4.0.0.
  • Updated wikimedia/minify from 2.2.4 to 2.2.6.
  • Updated wikimedia/object-factory from 3.0.2 to 4.0.0.
  • Updated wikimedia/parsoid from v0.14.0-a14 to v0.15.0.
  • Updated wikimedia/purtle from 1.0.7 to 1.0.8.
  • Updated wikimedia/request-timeout from 1.1.0 to 1.2.0.
  • Updated wikimedia/shellbox from 2.0.0 to 3.0.0.
  • Updated wikimedia/wrappedstring from 3.2.0 to 4.0.1.
Changed development-only external libraries edit
  • Updated QUnit from 2.16.0 to 2.18.0.
  • Updated composer/semver from 3.5.4 to 3.5.5.
  • Updated composer/spdx-licenses from 1.5.4 to 1.5.5.
  • Updated doctrine/dbal for PHP < 7.3 from 2.10.4 to 2.13.6.
  • Updated doctrine/dbal for PHP >= 7.3 from 3.0.0 to 3.1.5.

Removed external libraries edit

  • jquery.jStorage, deprecated since MW 1.28; use "mediawiki.storage" instead.

Action API changes in 1.38 edit

  • New `deletetalk` parameter on action=delete that allows you to delete the associated talk page of a subject page.
  • New `variant` parameter for all API actions, for specifying language variant (akin to the existing `variant` parameter for index.php). Task task T117549.

Languages updated in 1.38 edit

MediaWiki supports over 400 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

  • (task T292166) Updated namespace names for the Lombard language.
  • (task T299201) Changed the autonym of the Angika language to अंगिका
  • (task T298309) Changed the autonym of the Abkhaz language to аԥсшәа
  • (task T302972) Changed the autonym of the Kirundi language to ikirundi
  • (task T220303) Show numbered lists with Burmese numerals in relevant languages
  • (task T291899) Added language support for Xiang Chinese (hsn).
  • (task T292612) Added language support for S'gaw Karen (ksw).
  • (task T293656) Added language support for Farefare (gur).
  • (task T294729) Added language support for Pa'O (blk).
  • (task T296286) Added language support for Skolt Sámi (sms).
  • (task T296612) Added language support for Makhuwa (vmw).
  • (task T296707) Added language support for Ga (gaa).
  • (task T297073) Added language support for Nanai (gld).
  • (task T297074) Added language support for Nawdm (nmz).
  • (task T298075) Added language support for Northern Thai (nod).
  • (task T298182) Added language support for Cape Verdean Creole (kea).
  • (task T298385) Added language support for Nheengatu (yrl).
  • (task T299329) Added language support for Fon (fon).
  • (task T300474) Added language support for Nkore (nyn).
  • (task T302556) Added language support for Pannonian Rusyn (rsk).

Breaking changes in 1.38 edit

  • (task T291008) The IP class, deprecated since 1.35 in favor of the IPUtils library, has been removed. The IP related regexes which were also deprecated in favor of the IPUtils library were also removed, IPUtils::RE_* should be used instead.
  • (task T293043) The MediaWikiIntegrationTestCase class alias 'MediaWikiTestCase' has been removed.
  • LinkCache::singleton(), deprecated since 1.28, has been removed.
  • RepoGroup::singleton(), ::destroySingletons() and setSingleton(), all deprecated since 1.34, have been removed.
  • The following methods from FileDeleteForm were removed:
    • ::__construct (the class is no longer newable)
    • ::execute()
    • ::haveDeletableFile()
    Use FileDeleteAction instead.
  • MessageCache::singleton(), deprecated since 1.34, has been removed.
  • LockManagerGroup::singleton() and ::destroySingletons(), both deprecated since 1.34, have been removed.
  • FileBackendGroup::singleton() and ::destroySingletons(), both deprecated since 1.35, have been removed.
  • TemplateParser used to support disabling the cache with a boolean parameter in its constructor. This was deprecated in 1.35 and has now been removed.
  • The ArticleUndeleteLogEntry hook, deprecated in 1.37, was removed.
  • The BeforeResetNotificationTimestamp hook, deprecated in 1.37, was removed.
  • The global function mimeTypeMatch() has been removed without a deprecation process.
  • The following JavaScript mw.config keys have been removed:
    • $wgCookiePrefix
    • $wgCookieDomain
    • $wgCookiePath
    • $wgCookieExpiration
    Use mw.cookie from the mediawiki.cookie module instead.
  • The signature of PageUpdater::markAsRevert method was changed. It has never been used outside of MediaWiki core.
  • If you want to use interwiki titles with HTMLTitleTextField, you now need to pass 'interwiki' => true. In 1.37, the default behavior was to let interwiki title through by default, logging a deprecation warning.
  • The `UndeleteForm::undelete` hook, deprecated in 1.37, was removed.
  • BagOStuff::setDebug(), deprecated since 1.36, has been removed.
  • The `jquery.mw-jump` ResourceLoader module was removed.
  • The `wgForeignUploadTargets` and `wgEnableUploads` configuration values were removed from mw.config. They had previously been documented as being included for internal use by the mediawiki.ForeignUpload module.
  • The `&$hasHistory` parameter to WikiPage::getAutoDeleteReason() and ContentHandler::getAutoDeleteReason() was hard-deprecated with no replacement.
  • Several Skin methods, which have emitted deprecation warnings since 1.36, have been removed. These include:
    • Skin::privacyLink()
    • Skin::aboutLink()
    • Skin::disclaimerLink()
      For these, instead use Skin::footerLink() to alter footer links.
    • Skin::getLogo()
      For this, use ResourceLoaderSkinModule::getAvailableLogos() instead.
    • Skin::getIndicatorsHTML()
      For this, use Skin::getIndicatorsData() instead.
    • Skin::subPageSubtitle()
      For this, use Skin::prepareSubtitle() instead.
    • Skin::makeVariablesScript()
      For this, use ResourceLoader::makeInlineScript() instead.
    • Skin::getAllowedSkins()
    • Skin::getSkinNames()
      For these, use SkinFactory::getAllowedSkins() or ::getInstalledSkins().
    • Skin::makeUrl()
    • Skin::getSearchLink()
    • Skin::mainPageLink()
  • Parser::getUser and ::mUser, as well as ParserOptions::getUser, deprecated since 1.37, has been removed.
  • Parser::$mStripState, deprecated in 1.35, has been made private. Use Parser::getStripState() instead.
  • The following deprecated features in blocks were removed:
    • DatabaseBlock constructor 'byText' property with blocker's name, use 'by' property with UserIdentity value instead.
    • DatabaseBlock constructor 'by' property with blocker's ID, use 'by' property with UserIdentity value instead.
    • DatabaseBlock::isWhitelistedFromAutoblocks, use ::isExemptedFromAutoblocks.
    • DatabaseBlock::setBlocker now only accepts UserIdentity.
    • AbstractBlock::getTargetAndType and ::getTarget, use ::getTargetName, ::getTargetUserIdentity and ::getType instead
  • The following functions, emitting deprecations since 1.37, have been removed:
    • Title::isWatchable()
    • WatchAction::doWatchOrUnwatch(), WatchAction::doWatch(), WatchAction::doUnwatch(), WatchAction::getWatchToken()
    • User::isWatched(), User::isTempWatched(), User::addWatch(), User::removeWatch()
  • ParserOptions::setTidy() that had no effect and was deprecated since 1.35 has been removed.
  • The "YAML" encoding option of EtcdConfig, has been removed without deprecation.
  • The constant ApiBase::PARAM_VALUE_LINKS, deprecated since 1.35 has been removed.
  • UserLoadOptions, UserSaveOptions and UserResetAllOptions hooks, deprecated since 1.37, were removed.
  • The experimental FileJournal system has been removed without deprecation. This includes the FileJournal abstract class, its implementation classes DBFileJournal and NullFileJournal, various minor getters and setters, and the option for the wiki configuration $wgFileBackends.
  • The return values for each `bind` function in checkboxHack.js has been changed from an object to a function. In addition, the `unbind` function has been removed. A deprecation process was assumed unnecessary as there were no known usages.
  • File::getUser, ::getImageSize, ArchivedFile::getRawDescription, ::getUser, ::getRawUser and ::getRawDescription, deprecated since 1.37, has been removed.
  • ShellboxHttpClient class has been removed without deprecation. It was an internal class used by ShellboxClientFactory.
  • The following hard deprecated User methods have been removed:
    • ::resetIdByNameCache,
    • ::getStubThreshold,
    • ::matchEditTokenNoSuffix,
    • ::changeableByGroup,
    • ::changeableGroups,
    • ::isAllowUsertalk,
    • ::getRights
    • ::isAllowUsertalk
    • ::isIP,
    • ::isIPRange,
    • ::isValidUserName,
    • ::isUsableName,
    • ::isCreatableName,
    • ::getCanonicalName,
    • ::addAutopromoteOnceGroups,
    • ::getDefaultOptions,
    • ::getDefaultOption,
    • ::getOptions,
    • ::getBoolOption,
    • ::getIntOption,
    • ::setOption
    • ::listOptionKinds
    • ::getOptionKinds,
    • ::resetOptions,
    • ::getEffectiveGroups,
    • ::getAutomaticGroups,
    • ::getFormerGroups
    • ::isLoggedIn
    • ::getFirstEditTimestamp
    • ::getLatestEditTimestamp
  • Http::$httpEngine, deprecated since 1.34, has been removed. The only available HTTP engine is now Guzzle. CurlHttpRequest and PhpHttpRequest classes were removed.
  • The UserRightsProxy class was deprecated. Pass the correct domain to UserGroupManagerFactory instead.
  • Parser option enableLimitReport was deprecated. The report is now generated post-parse and can be included by providing 'includeDebugInfo' option to ParserOutput::getText. Thus, ParserOptions::enableLimitReport and ::getEnableLimitReport methods were deprecated.
  • Ajax action that was deprecated in 1.27 now has been removed.
  • The following methods have been removed from IDatabase without deprecation as they were completely unused:
    • ::preCommitCallbacksPending()
    • ::pendingWriteRowsAffected()
    • ::getServerUptime()
    • ::maxListLen()
  • The following deprecated methods have been removed from IDatabase:
    • ::aggregateValue() soft-deprecated since 1.33
    • ::getTopologyRootMaster() since 1.37
    • ::masterPosWait() since 1.37
    • ::dataSeek() soft-deprecated since 1.37
    • ::numFields() soft-deprecated since 1.37
    • ::fieldName() soft-deprecated since 1.37
    • ::onTransactionIdle() soft-deprecated since 1.32
    • ::getMasterPos() since 1.37
  • DatabaseMysqlBase::fieldType() and DatabasePostgres::fieldType(), deprecated since 1.37, have been removed.
  • Database::assertIsWritableMaster(), deprecated since 1.37, has been removed.
  • ResultWrapper::getInternalResult(), soft-deprecated since 1.37 and ResultWrapper::unwrap(), deprecated since 1.37, have been removed.
  • Language::AS_AUTONYMS, deprecated since 1.34, has been removed. You can use the LanguageNameUtils::AUTONYMS constant instead.
  • Several Language class variables deprecated in 1.35 have been removed; they are each replaced by a constant, as listed after the arrow:
    • ::$mWeekdayMsgs → WEEKDAY_MESSAGES
    • ::$mWeekdayAbbrevMsg → WEEKDAY_ABBREVIATED_MESSAGES
    • ::$mMonthGenMsgs → MONTH_GENITIVE_MESSAGES
    • ::$mIranianCalendarMonthMsgs → IRANIAN_CALENDAR_MONTHS_MESSAGES
    • ::$mHebrewCalendarMonthMsgs → HEBREW_CALENDAR_MONTHS_MESSAGES
    • ::$mHebrewCalendarMonthGenMsgs → HEBREW_CALENDAR_MONTH_GENITIVE_MESSAGES
    • ::$mHijriCalendarMonthMsgs → HIJRI_CALENDAR_MONTH_MESSAGES
  • wfIncrStats, deprecated since 1.36, has been removed.
  • Profiler::profileIn and ::profileOut, deprecated in 1.33, has been removed.
  • IEditObject::AS_CANNOT_USE_CUSTOM_MODEL, deprecated in 1.35, was removed.
  • Several protected methods in EditPage were made private. None of these was used outside of EditPage itself. Since the class is not stable to extend, this change happened without a deprecation phase.
  • The following public methods in EditPage, unused externally, were made private:
    • ::getCancelLink()
    • ::isSupportedContentModel()
    • ::getParentRevId()
  • EditPage::setApiEditOverride() was marked as @internal for use by ApiEditPage only.
  • SelectQueryBuilder::straightJoin() was renamed to straightJoinOption().
  • The following deprecated methods have been removed from ILBFactory:
    • ::beginMasterChanges() since 1.37
    • ::commitMasterChanges() since 1.37
    • ::rollbackMasterChanges() since 1.37
    • ::hasMasterChanges() since 1.37
    • ::hasOrMadeRecentMasterChanges() since 1.37
  • The "groupLoadsByDB" option to LBFactoryMulti has been removed. Consider using "groupLoadsBySection" instead.
  • The following methods have been removed from ILoadBalancer without deprecation as they were completely unused:
    • ::waitForOne()
    • ::allowLagged()
    • ::forEachOpenReplicaConnection()
  • The following deprecated methods have been removed from ILoadBalancer:
    • ::getMasterPos() since 1.37
    • ::finalizeMasterChanges() since 1.37
    • ::approveMasterChanges() since 1.37
    • ::beginMasterChanges() since 1.37
    • ::commitMasterChanges() since 1.37
    • ::runMasterTransactionIdleCallbacks() since 1.37
    • ::runMasterTransactionListenerCallbacks() since 1.37
    • ::rollbackMasterChanges() since 1.37
    • ::flushMasterSnapshots() since 1.37
    • ::hasMasterConnection() since 1.37
    • ::hasMasterChanges() since 1.37
    • ::lastMasterChangeTimestamp() since 1.37
    • ::hasOrMadeRecentMasterChanges() since 1.37
    • ::pendingMasterChangeCallers() since 1.37
    • ::forEachOpenMasterConnection() since 1.37
    • ::waitForMasterPos() since 1.37
  • LoadBalancer::safeGetLag() which has been soft-deprecated since 1.34 has been removed.
  • The following properties of the EditPage class, deprecated since 1.35, were made private:
    • ::$deletedSinceEdit
    • ::$lastDelete
    • ::$mTokenOk
    • ::$mTriedSave
    • ::$incompleteForm
    • ::$tooBig
    • ::$missingComment
    • ::$missingSummary
    • ::$allowBlankSummary
    • ::$autoSumm
    • ::$mParserOutput
    • ::$hasPresetSummary
    • ::$minoredit
    • ::$watchthis
    • ::$recreate
    • ::$nosummaryparentRevId
    • ::$editintro
    • ::$scrolltop
    • ::$markAsBot
  • Special:ListFiles and Special:NewFiles no longer allows to search for parts of file names (option was not available for $wgMiserMode = true)
  • DBAccessBase, deprecated since 1.37, has been removed.
  • The UserNamePrefixSearch service no longer supports a UserIdentity parameter to search(), to check for a specific audience an Authority object is required.
  • The methods CoreParserFunctions::register() and CoreTagHooks::register() have been marked @internal, and had a seconds parameter added. These methods are intended for use in Parser's constructor, and are not used by any known extension.
  • LoadBalancer::openConnection(), deprecated since 1.34, has been removed.
  • Skin::preloadExistence has been made private. There is no known usages outside of MediaWiki core.

Deprecations in 1.38 edit

  • The MWGrants class is deprecated in favor of the new GrantsInfo and GrantsLocalization services.
  • The global functions wfReadOnly() and wfReadOnlyReason() have been deprecated in favor of the ReadOnlyMode service.
  • PageProps::getInstance() has been deprecated. Use MediaWikiServices::getPageProps() instead.
  • User::setOption(), deprecated since 1.35, now emits deprecation warnings.
  • Linker::formatComment(), ::formatLinksInComment(), ::commentBlock() and revComment() were deprecated. Use the new CommentFormatter service.
  • Several Skin methods have been deprecated.
    • Skin::setSearchPageTitle(), Skin::getSearchPageTitle(). For these, use SpecialPage::newSearchPage() or associated user preference instead.
    • Skin::getSkinStylePath now triggers deprecation warnings. Direct string path should be used instead.
    • SkinTemplate::getPersonalToolsList(), deprecated since 1.35, now emits deprecation warnings.
    • In preparation for SkinTemplate::getPortletData becoming a private function, extending the method is no longer permitted. Use SkinTemplate::getTemplateData instead.
    • SkinTemplate::buildContentNavigationUrls is now deprecated. Skins can use the runOnSkinTemplateNavigationHooks method or the SkinTemplateNavigation__Universal hook if they need access to this data.
  • Usage of several template data keys in QuickTemplate are now deprecated:
    • searchaction, poweredbyico, copyrightico
  • DatabaseBlock::purgeExpired(), deprecated since 1.36, now emits deprecation warnings.
  • The following methods from the User class now trigger deprecation warnings:
    • ::blockedBy
    • ::getBlockId
  • Content::getParserOutput and AbstractContent::fillParserOutput was hard-deprecated, use ContentRenderer::getParserOutput instead. Extensions defining a content model should override ContentHandler::fillParserOutput.
  • Title::newFromIDs and TitleFactory::newFromIDs have been hard deprecated. Use a PageSelectQueryBuilder from a PageStore instead.
  • Content::getRedirectChain() and Content::getUltimateRedirectTarget() have been deprecated with no replacement because support for $wgMaxRedirect will be removed completely. See task T296430 for more information.
  • WikiPage::getRedirectTarget() has been deprecated. Use the equivalent RedirectLookup::getRedirectTarget() instead.
  • Article::doDelete() was deprecated. Use WikiPage::doDeleteArticleReal if you only need to delete the article. If you also need things to happen with OutputPage, you may want to check the hooks in DeleteAction instead.
  • Instantiating the MessageContent class now emits deprecation notices.
  • Message::content() now triggers deprecation warnings.
  • Parser::setDefaultSort(), Parser::getDefaultSort(), and Parser::getCustomDefaultSort() now trigger deprecation warnings. Use ParserOutput::{get,set}PageProperty('defaultsort') instead.
  • The following methods from the ParserOutput class now emit deprecation warnings:
    • ::hideNewSection() - use ::setHideNewSection()
    • ::preventClickjacking() - use ::{get,set}PreventClickjacking()
    • ::getProperty() - use ::getPageProperty() (return value changed)
    • ::setProperty() - use ::setPageProperty()
    • ::unsetProperty() - use ::unsetPageProperties()
    • ::getProperties() - use ::getPageProperties()
    • ::getCategoryLinks() - use ::getCategoryNames()
    • ::setCategoryLinks() - use ::setCategories()
    • ::addTrackingCategory() - use Parser::addTrackingCategory() or TrackingCategories::addTrackingCategory()
    • ::addWarning() - use ::addWarningMsg()
    • ::hasDynamicContent() - use ::hasReducedExpiry()
  • The following methods from the ParserOutput class were deprecated:
    • ::getFlag() - use ::getOutputFlag()
    • ::setFlag() - use ::setOutputFlag()
    • ::getAllFlags() - this method is now marked @internal
    • ::addJsConfigVars() - use ::setJsConfigVar() or ::appendJsConfigVar()
    • ::addOutputHook() / ::getOutputHooks() - these hooks should be migrated to use the OutputPageParserOutput hook instead
  • The use of ParserOutput::setExtensionData() to overwrite previous values stored under a given key has been deprecated; use the new ::appendExtensionData() to collect multiple values in the ParserOutput rather than destructively updating stored values. (task T300981)
  • The signatures of the following methods from the ParserOutput class were narrowed, restricting the permitted argument types:
    • ::addModules() - if you formerly passed a string, pass an array with the string as the only element.
    • ::addModuleStyles() - if you formerly passed a string, pass an array with the string as the only element.
  • Access to the following public or protected properties of OutputPage was deprecated; they will be made private or removed in a future release. Use accessor functions instead.
    • ::$mCategoryLinks
    • ::$mCategories
    • ::$mIndicators
    • ::$mHeadItems
    • ::$mModules
    • ::$mModuleStyles
    • ::$mJsConfigVars
    • ::$mTemplateIds
    • ::$mEnableClientCache
    • ::$mNewSectionLink
    • ::$mHideNewSectionLink
    • ::$mNoGallery
  • The following methods were deprecated; use ::setPreventClickjacking(..) instead:
    • OutputPage::preventClickjacking()
    • OutputPage::allowClickjacking()
    • ImageHistoryList::preventClickjacking()
    • ImageHistoryPseudoPager::preventClickjacking()
    • ContribsPager::preventClickjacking()
  • OutputPage::enableClientCache() was deprecated, because it is universally used to do the opposite -- use OutputPage::disableClientCache() instead.
  • Sanitizer::removeHTMLtags() has been deprecated. Its output can include unbalanced or ill-formed HTML and thus external callers may be misled about how to safely incorporate its output into a page. It is recommended to use the new Sanitizer::removeSomeTags() method instead, which will always return balanced HTML.
  • EventRelayerKafka was deprecated. To use $wgEventRelayerConfig with Kafka, add a similar class to your code.
  • MediaWiki\Logger\Monolog\KafkaHandler was deprecated. Consider using $wgMWLoggerDefaultSpi with SyslogHandler, or to use Kafka, add a similar Monolog handler class to your code.
  • Collation::singleton() and ::factory() now trigger deprecation warnings.
  • The following methods in MWNamespace, all deprecated since 1.34, now emit deprecation warnings:
    • isTalk()
    • exists()
    • subjectEquals()
    • getCanonicalNamespaces()
    • getCanonicalName()
    • getCanonicalIndex()
    • getValidNamespaces()
    • isContent()
    • hasSubpages()
    • getContentNamespaces()
  • Return values in the parameter $pageLang of the hook PageContentLanguage with other types than a Language object, deprecated since 1.33, now emits deprecation warnings.
  • Passing a db to BlockRestrictionStore::loadByBlockId() is deprecated. BlockRestrictionStoreFactory should be used to fetch a correct BlockRestrictionStore instead.
  • All external access to ParserOutput and CacheTime classes properties will now emit deprecation warnings. Use getters and setters instead.
  • The custom jQuery event `watchpage.mw` emitted on #ca-watch and #ca-unwatch is now deprecated in favour of the new `wikipage.watchlistChange` hook.
  • The global function wfLogProfilingData() has been deprecated without a replacement. The logic has been moved to the MediaWiki class.
  • The "trace" option of SectionProfiler has been deprecated.
  • The PageArchive class has had several methods deprecated. The replacements are as follows:
    • Use UndeletePage instead of ::undeleteAsUser(), ::getFileStatus() and ::getRevisionStatus().
    • Use the respective methods of the new ArchivedRevisionLookup service instead of ::listRevisions, ::getRevisionRecordByTimestamp, ::getArchivedRevisionRecord, ::getPreviousRevisionRecord and ::getLastRevisionId.
    • Use ArchivedRevisionLookup::hasArchivedRevisions instead of ::isDeleted.
  • PageUpdater::isUnchanged() has been deprecated, use wasRevisionCreated() instead.
  • The `mediawiki.pager.tablePager` module was deprecated in favor of the more generic `mediawiki.pager.styles`.
  • wfGetCache() and wfGetMainCache(), both deprecated since 1.32, now emit deprecation warnings.
  • LinkCache::addGoodLinkObj() has been hard deprecated.
  • ApiStashEdit::parseAndStash has been hard deprecated.
  • Content::prepareSave was hard-deprecated, now emits deprecation warnings. Use ContentHandler::validateSave instead.
  • The hooks LinksUpdateAfterInsert and LinksUpdateConstructed were deprecated.
  • Access to all public properties in LinksUpdate was deprecated.
  • The global variable $IP has been deprecated for use in application logic. It will remain available for use in LocalSettings.php for now, though $wgBaseDirectory is preferred. Application logic should use the BaseDirectory setting from the main config. Tests and framework code that need to function without MediaWiki being fully initialized should use the MW_INSTALL_PATH constant.
  • The global function wfWikiID(), deprecated since 1.35, now emits deprecation warnings.
  • AbstractBlock::getBy() now takes a wikiId as a parameter and emits deprecation warnings in case of cross-wiki accesses.
  • The `button` parameter for `bindUpdateAriaExpandedOnInput` and `updateAriaExpanded` in checkboxHack.js have been deprecated. `bindToggleOnSpaceEnter` has also been deprecated in favor of `bindToggleOnEnter`.
  • IDatabase::lockTables() and IDatabase::unlockTables() have been deprecated with no replacement. Instead, callers should batch updates into atomic transactions, using FOR UPDATE for SELECT queries.
  • EditPage::addNewLineAtEnd() was deprecated; use TextboxBuilder::addNewLineAtEnd instead.
  • EditPage::getCopywarn() was deprecated; use EditPage::getCopyrightWarning instead.
  • EditPage::getCopyrightWarning() without passing a MessageLocalizer parameter has been deprecated.
  • Passing the $formCallback parameter to EditPage::showEditForm, deprecated in 1.25 and previously emitting a warn notice, now emits a deprecation notice.
  • EditPage::$action has been deprecated.
  • The following properties in EditPage now emit deprecation notices when used from another class:
    • mArticle (use ::getArticle() instead)
    • mTitle (use ::getTitle() instead)
    • isNew (no replacement)
    • allowBlankArticle (no replacement)
    • selfRedirect (no replacement)
    • allowSelfRedirect (no replacement)
    • diff (no replacement)
    • textbox2 (no replacement)
    • undoAfter (no replacement)
    • edit (no replacement)
    • contentLength (no replacement)
  • The HTMLForm methods getPreText, setPreText, addPreText, getPostText, setPostText, addPostText, getHeaderText, setHeaderText, addHeaderText, getFooterText, setFooterText and addFooterText have been renamed to getPreHtml, setPreHtml, addPreHtml, getPostHtml, setPostHtml, addPostHtml, getHeaderHtml, setHeaderHtml, addHeaderHtml, getFooterHtml, setFooterHtml and addFooterHtml respectively.
  • The FormSpecialPage methods preText and postText have been renamed to preHtml and postHtml respectively.
  • Article::doDelete, deprecated in 1.37, now emits deprecation notices.
  • The following Less mediawiki.mixins have been deprecated:
    • .background-image()
    • .list-style-image()
  • Category::getPageCount now takes a parameter. Category::COUNT_ALL_MEMBERS return count of all members while Category::COUNT_CONTENT_PAGES return that of content pages. For the former behavior use Category::getMemberCount()
  • Using `new HTMLForm( … )` or `HTMLForm::factory( … )` without the $context parameter is now deprecated.
  • BagOStuff::incr() and BagOStuff::decr() are now deprecated.
  • Action::exists() and ActionFactory::actionExists() are deprecated, use (bool)ActionFactory::getAction().

Other changes in 1.38 edit

  • The following things were changed in the file deletion form:
    • The name and ID of the submit button are now `wpConfirmB`, not `mw-filedelete-submit`
    • The ID of the form is now `deleteconfirm`, not `mw-img-deleteconfirm`
    • The `mw-filedelete-editreasons` class was replaced with `mw-delete-editreasons`
    The goal of these changes is to make the HTML more similar to that of normal page deletion.
  • ParserOptions created with ::newFrom* or ::newCanonical are now identical.
  • MediaWiki initialization order have been changed to load vendor autoload earlier. This means that extensions that are installed via composer and execute code upon autoloading can not depend on any MediaWiki classes, constants or globals in that code.
  • The source of truth for configuration defaults is now the MainConfigSchema class. DefaultSettings.php still exists for backwards compatibility. A PHP file generated for optimized loading will be used in Setup.php to initialize configuration variables. Setup.php can be made to load DefaultSettings.php as before by setting MW_USE_LEGACY_DEFAULT_SETTINGS as an environment variable (e.g. via SetEnv in htaccess) or a PHP constant (e.g. via auto_prepend_file in php.ini).

Compatibility edit

MediaWiki 1.38 requires PHP 7.3.19 or later and the following PHP extensions:

  • ctype
  • dom
  • fileinfo
  • iconv
  • intl
  • json
  • mbstring
  • xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used, but support for them is somewhat less mature.

The supported versions are:

  • MySQL 5.5.8 or later
  • PostgreSQL 9.4 or later
  • SQLite 3.8.0 or later

Online documentation edit

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list edit

A mailing list is available for MediaWiki user support and discussion:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help edit

There's usually someone online in #mediawiki on irc.libera.chat.

MediaWiki 1.39 edit

MediaWiki 1.39.7 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since 1.39.6 edit

  • Localisation updates.
  • (T334992) Headings in the license pickers should not be selected.
  • (T353929) ActiveUsersPager: Count actions only once.
  • composer: Use @php instead of php.
  • (T326065) Indent JsonContent using tabs.
  • (T354541) authmanager: Improve AuthenticationRequest docs.
  • (T355017) Add missing space in Special:RecentChangesLinked.
  • (T355003) composer.json Add ext-bcmath and ext-gmp to suggests.
  • PHPVersionCheck: Update text to match currently supported upstream PHP versions (8.1+).
  • (T354045) API: mark HTML output as non-cacheable.
  • (T355530) filerepo: Fix img_major_mime for files with a non-standard extensions.
  • (T355530) MimeAnalyzer: Add @since to isValidMajorMimeType.
  • (T317489, T319202) Mark some parserTests on talk pages Parsoid only on REL1_39.
  • (T350594) Update wikimedia/parsoid to 0.16.3.
  • (T352554) ZhConverter: Fix language variant fallback chain.
  • (T357668) Parser::getExternalLinkAttribs: Don't set rel attribute to null.
  • LockManagerGroupIntegrationTest: Remove test depending on DBLockManager.
  • (T357808) LinkRendererTest: Add missing import for LinkTarget.
  • (T353305) ApiResetPassword: Allow both user and email parameters to be passed for reset.
  • (T358949) updateCollation: Explicitly cast $scale to int.
  • (T359055) api: Improve linking of language codes lists in top level i18n messages.
  • (T359294) Make sure MovePage::isValidFileMove matches UploadBase::getTitle.
  • (T230245) Respect $maxConcurrency when queuing async FileOps.
  • (T352554) Follow-up "ZhConverter: Fix language variant fallback chain".
  • (T292237, T317451) build: Restore Doxygen output for MediaWiki release tags.
  • (T324903) HistoryPager: Add #[AllowDynamicProperties].
  • (T360850) Update Apache config syntax in .htaccess files.
  • (T309714, T354274) mime: Add support for 'font/woff' and 'font/woff2' mime type.
  • (T309714) mime: Make test cases use data provider.
  • (T331608) installer: Bear with schema drift caused by running old updater.
  • docs: Remove use of $IP from mwdocgen.php.
  • (T317451) build: Restore Doxygen output for MediaWiki release tags (take 3).
  • docs: Set stable permalink on markdown files.
  • (T357019) allow maintenance/deleteBatch.php to accept page ID.
  • (T355538, CVE-2024-PENDING) XSS in edit summary parser.
  • (T357760, CVE-2024-PENDING) Denial of service vector via GET request to Special:MovePage on pages with thousands of subpages.

MediaWiki 1.39.6 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.5 edit

  • Localisation updates.
  • Updated symfony/polyfill-php80 from 1.26.0 to 1.28.0.
  • Updated symfony/polyfill-php81 from 1.26.0 to 1.28.0.
  • (T344912) mail: Encode period (ascii 46) if it appears in encoded email header.
  • Added symfony/polyfill-php82.
  • Added symfony/polyfill-php83.
  • Updated symfony/yaml from 5.4.10 to 5.4.23.
  • (T329609) ApiQueryLanguageinfoTest: Do not pass a float to setFakeTime.
  • Updated wikimedia/timestamp from 4.0.0 to 4.1.1.
  • tests: Provide coverage for StatusValue::__toString.
  • StatusValue: Improve logging/debug output with multibyte characters.
  • (T347726, CVE-2023-PENDING) SECURITY: logging: Fix non-escaped messages used in rights log.
  • Updated wikimedia/parsoid from 0.16.1 to 0.16.2.
  • (T229992) LocalisationCache: Preserve fallback source language info.
  • (T275085) Fix logging Status objects to 'authevents' channel.
  • (T341310) DEVELOPERS.md: mention git clone and WSL.
  • (T351758) DEVELOPERS.md: reword WSL instructions to include best practices.
  • (T349115) LocalisationCache: Fix a rare case in fallback source language.
  • SwiftFileBackend: Fix "PHP Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated".
  • maintenance: Add missing parenthesis to SQL in attachLatest.php.
  • (T353472) maintenance: Fix join condition in DeduplicateArchiveRevId.

MediaWiki 1.39.5 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.4 edit

  • Localisation updates.
  • (task T333050, CVE-2023-45363) SECURITY: Fix infinite loop for self-redirects with variants conversion.
  • docs: Fix a few typos in MainConfigSchema.
  • (task T309714) mime: Add support for 'font/sfnt' MIME type.
  • (task T341434) WikiImporter: Improve error message output.
  • (task T317255) VueComponentParser: Use Zest's getElementsByTagName() rather than PHP's.
  • (task T341737) ApiBase: Cast $id to string in filterIDs.
  • (task T286291, task T296188) Merge zh and zh-tw namespace translations back to zh-hans, zh-hant, zh-hk respectively.
  • (task T337875) WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.
  • (task T237898) installer: Check MariaDB version in updater/installer.
  • (task T342632) ApiComparePages: Add help url.
  • (task T326182, task T324903) EditPage: Add #[AllowDynamicProperties].
  • (task T342351) rdbms: Fix postgres db function call.
  • (task T343675) user: Use {@} to escape annotation when writting about annotation.
  • (task T343797) LanguageWa: Fix double timezone adjustment.
  • (task T326454) Update pear/mail to 1.5.1.
  • (T204470) Remove feedback messages from RawHtmlMessages.
  • (T264765, CVE-2023-45364) SECURITY: Article: Check permissions before showing link to view deleted revision.
  • (T310378) Ensure that installer i18n is loaded by update.php.
  • (task T343622) docs: Set the <comment> tag back to optional.
  • (task T330528) Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.
  • (task T337463) wdio-mediawiki: await saveScreenshot.
  • (task T274041) Include core PSR-4 classes in the generated classmap.
  • (task T208477) $wgPrivilegedGroups – Users belonging in some of the listed groups will be audited more aggressively.
  • doc: Improve description of "type" in extension.schema.v2.json.
  • Added PrivilegedGroups attribute for extension.json / skin.json, which lets you add any new user groups you define to wgPrivilegedGroups (see above).
  • HTMLForm: Fix E_NOTICE when hide-if is used with setFormIdentifier.
  • (task T288624) MultiHttpClient: Unset $this->cmh after closing it.
  • (task T345039) Do not run SkinAfterBottomScripts hook twice unconditionally.
  • (task T265734) API Help: Note that parameters may be inherited from other context.
  • API: Make continue parameter help description more specific.
  • (task T285545) i18n: Split apihelp for standard dir parameter.
  • (task T285545) i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage show.
  • (task T285545) i18n: Split apihelp for parameter list=deletedrevs&drprop=.
  • (task T285545) i18n: Split apihelp for parameter list=allpages&apprexpiry=.
  • (task T285545) i18n: Split apihelp for parameter action=opensearch&redirects=.
  • (task T285545) i18n: Split apihelp for parameter action=managetags&operation=.
  • (task T285545) api: Add message for list=watchlist&wlprop=expiry.
  • (task T334011) ApiComparePages: expose 'difftype' param if wikidiff2 is installed.
  • (task T342633) api: Add message for action=compare&prop=timestamp.
  • API: revids=… does not necessarily return the queried revisions.
  • (task T326696) user: Truncate option value in UserOptionsManager.
  • (task T326696) ApiOptions: Give warning if the value is too long.
  • API i18n: Add for byte count messages.
  • (task T235207) Get correct main page in API call examples.
  • doc: Make extension.schema.v2.json a valid JSON schema.
  • updateSpecialPages.php: Avoid implicit float conversion on modulo.
  • (task T347227) ImportReporter: Make callback functions public.
  • (task T346898) importDump: Unconditionally call $importer->setUsernamePrefix().
  • (task T204470) Remove feedback messages from RawHtmlMessages.
  • (task T264765, CVE-2023-45364) SECURITY: Article: Check permissions before showing link to view deleted revision.
  • (task T310378) Ensure that installer i18n is loaded by update.php.
  • doc: Improve description of type in extension.schema.v1.json.
  • (task T340217, CVE-2023-45359) SECURITY: Vector 2022: Numerous unescaped messages leading to potential XSS.
  • (task T340220, CVE-2023-45361) SECURITY: Vector 2022: vector-intro-page message is assumed to yield a valid title.
  • (task T340221, CVE-2023-45360) SECURITY: XSS via 'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
  • (task T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression.
  • (task T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML file to Special:Upload (non-standard configuration).

MediaWiki 1.39.4 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.3 edit

  • Localisation updates.
  • (task T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.
  • (task T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7 (2.4.0 => 2.4.5).
  • (task T333776) Template:ACTIVEUSERS wasn't being updated without updateSpecialPages.php.
  • (task T258860) Prevent LogicCache exception from message cache during IO errors from memcache.
  • (task T336868) Improve idempotency of postgres index upgrades.
  • (task T322944) Add Authorization to default $wgAllowedCorsHeaders .
  • (task T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.
  • A fake MessageLocalizer for use in unit tests.
  • (task T338114) Title: Add forward alias.
  • composer: Add symfony/polyfill-php81 like symfony/polyfill-php80.
  • (task T330464) Work around argument corruption bug in XMLReader::open.
  • Fix frame and frameless rdfa depending on file existing.
  • Fixes for the phan upgrade, part 1.
  • Fixes for the phan upgrade, part 2.
  • (task T298571) build: Update mediawiki/mediawiki-phan-config to 0.12.0.
  • build: Updating mediawiki/mediawiki-phan-config to 0.12.1.
  • (task T329214) Pass whether current rev of file exists to Linker::makeBrokenImageLinkObj.
  • (task T334659) Handle thumb errors when !$enableLegacyMediaDOM.
  • A manualthumb that doesn't exist should be considered a thumb error.
  • (task T313157) IndexPager: Also protect against $offset being 0.
  • (task T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

MediaWiki 1.39.3 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.2 edit

  • Localisation updates.
  • (task T328477) LinksUpdate: Use DB key for category links table.
  • GlobalFunctions: Remove check for MEDIAWIKI constant.
  • (task T329484) API: Fix query+allimages user parameter description.
  • (task T330529) SpecialEditTags: Set default of for wpReason.
  • (task T330382) postgres: Make the upgrade ignore dropping indexes that might not exist.
  • (task T330526) htmlform: Handle null from HTMLFormField::getDefault in multiselects.
  • (task T291753) rdbms: escape backslashes in makeConnectionString for PostgreSQL.
  • (task T325529) Fix total breakage of wgCanonicalServer fallback.
  • (task T318103) mediawiki.storage: Disable async GC during integration test.
  • (task T332461, task T332397) TempFSFile: Keep the WeakMap alive.
  • (task T332902) page: fix InvalidArgumentException in SQLPlatform::makeList.
  • (task T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted XFF headers.

MediaWiki 1.39.2 edit

This is a maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.1 edit

  • Localisation updates.
  • (task T325872) ChangeTags: Remove table name from condition.
  • (task T324895) MWCallbackStream: Add explicit $stream property.
  • (task T297031, task T326039) PostgresUpdater: Move setDefault ahead of changeNullableField.
  • (task T321319) Produce HTML for invalid JSON.
  • (task T215466, task T326071) MigrateActors: Write to revision table (Follow-up 24115a8).
  • (task T223027) ReservedUsernames config: Add reserved names from maintenance scripts.
  • (task T325000, task T324896, task T307631) Updated OOUI from v0.44.3 to v0.44.5.
  • Remove /images .htaccess rules that are no longer relevant.
  • Disable php in .htaccess of images directory as a hardening measure.
  • (task T322583) Include missing message parameter in message.
  • LocalFileTest: use encodeBlob/decodeBlob for img_metadata.
  • DatabaseSqlite: fix null blobs.
  • rdbms: avoid pg_escape_bytea() call-style deprecation notices.
  • (task T322278) Improve LocalisationCache post-merge validation check.
  • (task T324408, task T326367) Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
  • (task T322278) Fix the remaining Phan failures on PHP 8.1.
  • (task T322278, task T326367) Respond to some messages from Phan on PHP 8.1.
  • Fix phan error when Excimer is enabled.
  • (task T326021) Add matrix: to $wgUrlProtocols .
  • (task T314099) stream wrapper: Declare $context class property.
  • (task T314099) libs\jsminplus: Declare JSNode::$expression.
  • (task T314096) composer.json: Updated composer/spdx-licenses from 1.5.6 to 1.5.7.
  • (task T326472) Upgrading cssjanus/cssjanus (v2.1.0 => v2.1.1).
  • (task T308536) rdbms: Remove deprecation mark for $wgSharedDB .
  • (task T215466, task T326071) installer: Split drop action out of the SQL patch for actor migration.
  • (task T322603) SqliteMaintenance.php: Fix fatally broken instanceof check.
  • (task T326377) rdbms: Use DBConnRef in SelectQueryBuilder.
  • api/en.json: api-help-datatype-expiry add missing 'may'.
  • (task T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
  • (task T328222) Pass empty string to strlen() if schema is null for PostgresDatabase.
  • (task T289926) SpecialRevisionDelete: Set default of for wpReason.
  • (task T155582, task T328503) Fix XML dumps for content types with non-string getNativeData().
  • (task T326886) PoolCounterRedis: Fix wrong cast, locks weren't being released.
  • (task T314099) revisiondelete: Replace dynamic property Status::$itemStatuses
  • (task T327821) skin: Restore default 'value' attribute in makeSearchButton().
  • (task T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
  • (task T329415) Clear the statsd data buffer regardless of StatsdServer config.
  • (task T292348) WikiImporter: do not fail if upload entry in dump lacks 'text' tag.
  • (task T330049) UnregisteredLocalFile: Don't call MimeAnalyzer if no path.
  • (task T324894 TempFSFile: Use a WeakMap for reference tracking if available.
  • (task T295637) Add no to fallback chain of nb and nn.

MediaWiki 1.39.1 edit

This is a security and maintenance release of the MediaWiki 1.39 branch.

Changes since MediaWiki 1.39.0 edit

  • Localisation updates.
  • PostgresUpdater: Remove trailing space from 'user_id ' column.
  • (task T304515) LCStoreStaticArray: atomically replace the cache file.
  • (task T324516) postgres: Fix upgrade for templatelinks primary key.
  • (task T324890, task T324891, task T324901) Parser: Allow dynamic properties on PHP 8.2.
  • (task T324513) uuid\GlobalIdGenerator: Check if getmyuid() exists.
  • (task T314099) OutputPage: Remove unused dynamic property ParserOptions->isBogus.
  • (task T314099) api: Remove use of undeclared property in action=comparepages.
  • Upgrading wikimedia/xmp-reader (0.8.5 => 0.8.6).
  • (task T324489) Upgrading wikimedia/parsoid (v0.16.0 => v0.16.1).
  • Updated pear/mail (v1.4.1 => v1.5.0).
  • Removed wikimedia/dodo (v0.4.0).
  • (task T324910) On pages using multi-content revisions, the raw content of a specific slot can be retrieved using the action=raw&slot=<role-name> query parameters.
  • (task T322637) SECURITY: sqlite should not create DB file world-readable.

MediaWiki 1.39.0 edit

Changes since MediaWiki 1.39.0-rc.1 edit

  • Localisation updates.
  • exception: Tolerate no service container when trying DB rollback.
  • (task T320282) Upgrading wikimedia/xmp-reader (0.8.3 => 0.8.4).
  • objectcache: Deprecate WANObjectCache::reap() and ::reapCheckKey().
  • (task T320864) When calling mail(), use an array for headers.
  • Upgrading wikimedia/xmp-reader (0.8.4 => 0.8.5).
  • (task T321154) Call setFormIdentifier() on LogEventsList form.
  • When importing revision with same timestamp as latest revision, treat it as the new latest.
  • (task T320726) RandomImageGenerator::getImageSpec: Don't pass a float to mt_rand(), for PHP 8.1.
  • (task T298485, task T322360) WikiExporter: Avoid calling reload in processing every row.
  • (task T321551) pager: Fix null used for foreach in Pager::getNavigationBar.
  • (task T321551) pager: Remove unused AlphabeticPager::getOrderTypeMessages() support.
  • pager: Remove unused PagerNavigationBuilder::setExtra().
  • PagerNavigationBuilder: Document that nulls in setLinkQuery() etc. are allowed.
  • (task T322335) ApiQueryRevisionsBase: Fix 'rvdiffto' parameter handling on PHP 8.0.
  • (task T314096) TestFileEditor: Fix string interpolation.
  • (task T289926) api: Fix minor PHP 8.1 incompatibility in ApiOptions.
  • (task T322803) SpecialBotPasswords: Don't pass null to trim().
  • (task T289926) Fix incomplete ITextFormatter mocks.
  • Language: Handle ronna and quetta.
  • (task T72510) rdbms: make SqlitePlatform::tableName() apply double quotes.
  • (task T323373) Parser: Fix extractSections() behavior for PHP >= 8.0.
  • .gitattributes: Ship docker-compose.yml to the tarball.

MediaWiki 1.39.0-rc.1 edit

Changes since MediaWiki 1.39.0-rc.0 edit

  • Localisation updates.
  • (task T318481) composer: Drop symfony/php73-polyfill.
  • (task T318460) SpecialChangeEmail: Set default for returntoquery.
  • (task T318307) HTMLFormField::validate(): Update docs to permit all data types
  • (task T306802) docker: update to latest published images.
  • (task T318754) WebInstallerOptions::addPersonalizationOptions(): Close fieldset.
  • (task T227047) Soft-deprecate the remainder of ActorMigration.
  • (task T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results in an IP range check on Special:Contributions.
  • (task T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence of hidden users.
  • (task T307278, CVE-2022-41766) SECURITY: On action=rollback the message "alreadyrolled" can leak revision deleted user name.
  • (task T319186) .phan/config.php: Update minimum_target_php_version.
  • Tests: Explicit cast to int in RandomImageGenerator test (php8 warnings).
  • (task T319186) .phan/config.php: Update minimum_target_php_version.
  • (task T310243) Deprecate use of 'wvui-search' package.
  • utils: Fix return doc about false/null for UrlUtils::expand.
  • (task T319000) WebInstaller: Don't try and run trim() on null.
  • In the event of preg failure in MagicWordArray throw exception.
  • (task T318753) Installer: Disable logo dropper for now.

MediaWiki 1.39.0-rc.0 edit

Upgrading notes for 1.39 edit

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.31.

Some specific notes for MediaWiki 1.39 upgrades are below:

  • (task T278139) Drop PHP 7.3 support in MediaWiki 1.39; require 7.4.3 or higher.

For notes on 1.38.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.39 edit

  • The default serialization method for file meta-data has been changed to JSON. You can revert it to PHP by setting the 'useJsonMetadata' property to false in $wgLocalFileRepo .
  • The DBO_SSL flag in $wgDBservers and $wgLBFactoryConf has been deprecated in favour of a boolean "ssl" parameter.
  • $wgMangleFlashPolicy is deprecated and is no longer functional. Users who are somehow still using Flash as a browser extension will be exposed to CSRF vulnerabilities.

New configuration edit

  • $wgAutoCreateTempUser – configures automatic user creation on page save.
  • $wgCopyUploadAllowOnWikiDomainConfig – Configures if administrators can use the MediaWiki:Copyupload-allowed-domains system message to define which domains can be used with the upload-by-url tool.
  • $wgLBFactoryConf['configCallback'] can be set to a callback function that returns an array with keys to update in $wgLBFactoryConf . This can be used to update the database configuration on the fly, e.g. to take replica hosts out of rotation.
  • $wgCdnMatchParameterOrder can be set to false if MediaWiki is behind a CDN that re-orders query parameters. This will make the code that matches request URLs to canonical CDN URLs insensitive to parameter order.
  • $wgMultiShardSiteStats – split site_stats across multiple rows. Only useful for very large, heavily edited wikis. (task T306589)
  • $wgPrivilegedGroups – Users belonging in some of the listed groups will be audited more aggressively.

Changed configuration edit

Removed configuration edit

New user-facing features in 1.39 edit

  • Optional automatic user creation on page save ($wgAutoCreateTempUser )
  • Administrators now have the option to delete/undelete the associated "Talk" page when they are (un)deleting a given page. `deletetalk` and `undeletetalk` options were added to the 'delete' and 'undelete' action APIs in MW 1.38.
  • `=` is now a wikitext built-in magic word, expanding to `=`. This is conventionally used as an escape mechanism to allow the use of `=` in unnamed template arguments. Defining Template:= to expand to something other than `=` has been deprecated since 1.36, with affected pages put into a special tracking category for migration.
  • (task T284020) Bot passwords are now supported when using the REST API.

New developer features in 1.39 edit

  • Added optional $size param to SearchResultProvideThumbnail hook.
  • SearchResultProvideThumbnail hook interface moved from MediaWiki\Rest\Hook namespace to MediaWiki\Search\Hook.
  • JsonValidateSaveHook has been added to allow extensions to set additional pre-save validations for specific JSON pages (task T313254).
  • Added 'PermissionErrorAudit' hook, enabling extensions to audit permission errors on specfic actions (for instance, account registration failed attempts due to a block (task T306018)).

External library changes in 1.39 edit

New external libraries edit

  • Added Codex v0.1.1. This replaces the now deprecated wvui library.
  • Added symfony/polyfill-php81.
  • Added symfony/polyfill-php82.
  • Added symfony/polyfill-php83.
New development-only external libraries edit
  • Updated QUnit from 2.18.0 to 2.18.2.

Changed external libraries edit

  • Updated jQuery from v3.6.0 to v3.6.1.
  • Updated OOUI from v0.43.2 to v0.44.5.
  • Updated composer/semver from 3.2.6 to 3.3.2.
  • Updated cssjanus/cssjanus fromv2.1.0 to v2.1.1.
  • Updated pear/mail from v1.4.1 to v1.5.1.
  • Updated symfony/polyfill-php80 from 1.25.0 to 1.28.0.
  • Updated symfony/yaml from 5.4.3 to 5.4.23.
  • Updated vue/compat from 3.2.23 to 3.2.37.
  • Updated wikimedia/base-convert from 2.0.1 to 2.0.2.
  • Updated wikimedia/html-formatter from 3.0.1 to 4.0.3.
  • Updated wikimedia/ip-set from 3.0.0 to 3.1.0.
  • Updated wikimedia/minify from 2.2.6 to 2.3.0.
  • Updated wikimedia/php-session-serializer from 2.0.0 to 2.0.1.
  • Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
  • Updated wikimedia/running-stat from 1.2.1 to 2.1.0.
  • Updated wikimedia/scoped-callback from 3.0.0 to 4.0.0.
  • Updated wikimedia/services from 2.0.1 to 3.0.0.
  • Updated wikimedia/timestamp from 3.0.0 to 4.1.1.
  • Updated wikimedia/xmp-reader from 0.8.1 to 0.8.6.
Changed development-only external libraries edit
  • Updated composer/spdx-licenses from 1.5.5 to 1.5.6.
  • Updated doctrine/dbal for PHP < 7.3 from 2.13.6 to 2.13.9.
  • Updated doctrine/dbal for PHP >= 7.3 from 3.1.5 to 3.4.2.
  • Updated mediawiki/mediawiki-phan-config from 0.11.1 to 0.12.1.

Bug fixes in 1.39 edit

  • (task T314013) $wgExtraNamespaces no longer overrides canonical namespace names specified in extension.json files. While this setting can still be used to rename extension-defined namespaces, system administrators may need to run namespaceDupes.php after upgrading.

Action API changes in 1.39 edit

  • New `undeletetalk` parameter on action=undelete that allows you to restore all revisions of the associated talk page.

Languages updated in 1.39 edit

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

  • Actual localization was added for several languages, which were already in Names.php and even used for a Wikipedia:
    • (task T313200) Added language support for Rundi (Kirundi, rn).
    • (task T310976) Added language support for Tumbuka (ChiTumbuka, tum).
    • (task T314270) Added language support for Kanuri (kr).
  • (task T313199) Added language support for Sylheti (syl).
  • (task T311975) Added language support for Ghanaian Pidgin (gpe).
  • (task T307080) Added language support for Okinawan (ryu).
  • (task T307887) Added language support for Mooré (mos).
  • (task T308813) Added language support for Nigerian Pidgin (pcm).
  • (task T309763) Added language support for Tai Nüa (tdd).
  • (task T310040) Added language support for Fante (fat).
  • (task T311034) Added language support for Campidanese Sardinian (sro).
  • (task T315406) Fix the autonym of the Iñupiaq language to "Iñupiatun".
  • (task T315677) Removed French fallback from the Fula language (ff).
  • (task T304920) In Swahili, the "Media" namespace is now "Media", as in English, and the "File" namespace is now "Faili". The old name of the "File" namespace was "Picha", which has been kept for backwards compatibility. If you manage a wiki in Swahili, and you use "Faili:" as a namespace anywhere in wikitext, and you mean to use it as "Media:", these need to be replaced to "Media:".
  • (task T309866) Some namespace translations were updated for Kyrgyz (ky). The old ones are retained as aliases for backwards compatibility.
  • (task T117845) Started the renaming of the language codes for Serbian from sr-ec and sr-el to sr-cyrl and sr-latn.

Breaking changes in 1.39 edit

  • Basic non-JavaScript (Grade C) support has been dropped for Internet Explorer 9-10, Firefox 27-38, and Android 4.3-4.4.
  • The following methods, deprecated since 1.37, have been removed from IDatabase:
    • ::fetchObject()
    • ::fetchRow()
    • ::numRows()
    • ::freeResult()
  • Title::getDefaultNamespace(), deprecated since 1.37, has been removed.
  • The DBPrimaryPos class alias 'DBMasterPos' has been removed.
  • The global function wfGetLB(), deprecated since 1.27, has been removed.
  • Passing a db to BlockRestrictionStore::loadByBlockId() is no longer supported. BlockRestrictionStoreFactory should be used to fetch a correct BlockRestrictionStore instead. This was deprecated since 1.38.
  • The global function wfGetCache(), deprecated since 1.32, has been removed. You can use ObjectCache::getInstance() instead.
  • The global function wfGetMainCache(), deprecated since 1.32, has been removed. You can use ObjectCache::getLocalClusterInstance() instead.
  • MovePage::__construct() now requires that all parameters be passed. The fallback to MediaWikiServices emitted deprecation notices since 1.37.
  • WikiPage::doEditContent(), deprecated since 1.32, was removed.
  • WikiPage::prepareContentForEdit() now requires a UserIdentity parameter to be provided. Not providing one has been deprecated since 1.37.
  • EventRelayerKafka, deprecated in 1.38, was removed.
  • MediaWiki\Logger\Monolog\KafkaHandler, deprecated in 1.38, was removed.
  • The "trace" option of SectionProfiler, deprecated in 1.38, was removed.
  • The global function wfWikiID(), deprecated since 1.35, has been removed.
  • Database::wasKnownStatementRollbackError() was removed. Subclasses should override isKnownStatementRollbackError() instead.
  • Database::wasQueryTimeoutError() was removed. Subclasses should override isQueryTimeoutError() instead.
  • Database::buildSuperlative() has been removed without deprecation.
  • The following methods, deprecated in 1.37, have been removed:
    • Linker::setStubThreshold(), ::getStubThreshold().
    • LinkRendererFactory::createForUser().
    • ParserOptions::getStubThreshold(), ::setStubThreshold().
  • Changes to ResourceLoader modules:
    • The mediawiki.viewport module, deprecated in 1.37 has been removed. Use IntersectionObserver instead.
  • If you manage a wiki in Swahili, and you use "Faili:" as a namespace anywhere, and you mean to use it as "Media:", replace it with "Media:". See task T304920.
  • Changes to skins:
    • Skin::getCopyrightIcon(), ::getPoweredBy(), deprecated in 1.37 have been removed.
    • Skin::bottomScripts soft deprecated in 1.37, was hard deprecated. Skins using SkinTemplate must set bodyOnly as a skin option and remove lines of code generating html, body and head elements.
    • Skin::makeSearchButton and Skin::makeSearchInput were deprecated in 1.38. Use SkinTemplate methods with the same name or Skin::getTemplateData instead.
    • Styles for the HTML classes `warningbox`, `errorbox` and `successbox` have been removed in favor of Html class methods.
    • The feature `legacy` used inside ResourceLoaderSkinModule, deprecated in 1.37, will no longer ship any styles.
    • Skin::getSkinStylePath, deprecated since 1.36, has been removed.
    • Skin::getPortletData has been made private.
    • SkinTemplate::getPersonalToolsList(), deprecated in 1.35 has been removed.
    • The following SkinTemplate template data, deprecated in 1.37, have been removed:
      • poweredbyico
      • copyrightico
    • The following hooks, deprecated in 1.37, have been removed:
      • SkinGetPoweredBy: SkinGetPoweredByHook
    • The following hooks are deprecated and replaced with SkinTemplateNavigation::Universal:
      • SkinTemplateNavigation::SpecialPage
      • SkinTemplateNavigation
      • PersonalUrls
    • The mediawiki.skinning.content.externallinks module, which was deprecated in 1.36, has been removed. Skins that still rely on it will lose the icon styling of external links by type.
  • Experimental wiki farm support: Automatic detection of the requested site within a wiki farm based on the requested domain has been removed. Use the MW_WIKI_NAME environment variable to specify the name of the site to load configuration for. Using the WIKI_NAME environment variable for this purpose is deprecated. This is only relevant if you have been using $wgWikiFarmSettingsDirectory to load wiki farm config.
  • MWExceptionHandler::installHandler was marked @internal and had required arguments added. This method is intended for use in bootstrap code and is unused in known extensions.
  • MWException::useOutputPage was made private without deprecation. This method was apparently only public for testing and is unused in known extensions.
  • Calling getId() on a User or UserIdentityValue from the wrong wiki, deprecated since 1.36, now throws an exception.
  • The following methods have been removed from ExtensionRegistry without deprecation and without replacement. They had been introduced in 1.35 for use in the testing framework, and were not in use by any known extension:
    • exportAutoloadClassesAndNamespaces
    • exportTestAutoloadClassesAndNamespaces
  • The MWNamespace class, deprecated since 1.34, has been removed. Use the NamespaceInfo service instead.
  • The UnknownContent and UnknownContentHandler class aliases have been removed, use FallbackContent and FallbackContentHandler instead.
  • IResultWrapper::next() now returns void, to match the Iterator interface that it implements. fetchObject() has the same behavior as next() used to.
  • In HTMLForm HTMLAutoCompleteSelectFields, the parameters 'autocomplete' and 'autocomplete-messages', which were deprecated in MediaWiki 1.29, were removed. Instead, use 'autocomplete-data' and 'autocomplete-data-messages'.
  • The global $wgParser , deprecated in 1.32, was removed. Use MediaWikiServices::getInstance()->getParser() instead.
  • ParserOutput::setText will now set the ParserOutput's text to null if given null. Previously it did nothing if given null.
  • The default value for the first argument to the ParserOutput constructor is now null instead of .
  • IDatabase::lockTables() and IDatabase::unlockTables(), deprecated since 1.38, have been removed.
  • The $context parameter to `new HTMLForm( … )` and `HTMLForm::factory( … )` is now required.
  • The class alias for revision related classes in namespace MediaWiki\Storage has been removed. Classes are IncompleteRevisionException, MutableRevisionRecord, MutableRevisionSlots, RevisionAccessException, RevisionArchiveRecord, RevisionFactory, RevisionLookup, RevisionRecord, RevisionSlots, RevisionStore, RevisionStoreRecord, SlotRecord, and SuppressedDataException.
  • Calling getBy() on an AbstractBlock from the wrong wiki, deprecated since 1.38, now throws an exception.
  • Passing a MediaWiki\Linker\LinkTarget to EditPage::makeTemplatesOnThisPageList or TemplatesOnThisPageFormatter::format is no longer supported, a MediaWiki\Page\PageIdentity is required.
  • The deprecated class alias FakeConverter has been removed, use TrivialLanguageConverter instead.
  • The deprecated ApiQueryContributions class alias has been removed, use ApiQueryUserContribs instead.
  • The deprecated MediaWiki\Special\SpecialPageFactory class alias has been removed, use MediaWiki\SpecialPage\SpecialPageFactory instead.
  • The following skin modules, deprecated in 1.37, have been removed:
    • mediawiki.skinning.elements
    • mediawiki.skinning.content
    • mediawiki.toc.styles
    • mediawiki.legacy.config
    • mediawiki.legacy.shared
    • mediawiki.legacy.commonPrint
  • FileModule::compileLessFile(), deprecated since 1.35, has been removed. Use ::compileLessString() instead.
  • LogFormatter::styleRestricedElement(), deprecated since 1.37, has been removed. Use ::styleRestrictedElement() instead.
  • Title::isNamespaceProtected(), deprecated in 1.34, has been removed.
  • ApiStashEdit::parseAndStash(), deprecated in 1.34, has been removed.
  • LinkCache::forUpdate(), deprecated in 1.34, has been removed.
  • Passing null instead of a NamespaceInfo instance to LinkCache::__construct() is not supported anymore. It is recommended to request an instance from the service container.
  • ApiQueryBase::showHiddenUsersAddBlockInfo(), deprecated in 1.34, has been removed. Use ApiQueryBlockInfoTrait instead.
  • ApiQueryBase::prefixedTitlePartToKey(), deprecated in 1.35, has been removed. Use ::parsePrefixedTitlePart() instead.
  • ExternalStoreDB::getSlave(), deprecated in 1.34, has been removed. Use ExternalStoreDB::getReplica() instead.
  • ChangesListSpecialPage::checkStructuredFilterUiEnabled() and SpecialWatchlist::checkStructuredFilterUiEnabled() now support UserIdentity as the only argument. Passing Config argument was deprecated in 1.34.
  • DatabaseUpdater::ifNoActorTable(), deprecated in 1.35, has been removed. Use ::ifTableNotExists() instead.
  • MediaWiki\Revision\RevisionStoreFactory::getRevisionStore was documented to allow passing bool true as a dbDomain, this is no longer possible, because that is an invalid value for a dbDomain.
  • LinkHolderArray::__construct() had its signature changed. The class was marked internal in 1.35.
  • SpecialMute::isTargetBlacklisted(), deprecated in 1.35, has been removed. Use ::isTargetMuted() instead.
  • WebRequest::checkUrlExtension(), deprecated in 1.35, has been removed.
  • ContentHandler::cleanupHandlersCache(), deprecated in 1.35, has been removed.
  • SpecialVersion::getExtAuthorsFileName, deprecated in 1.35, has been removed. Use MediaWiki\ExtensionInfo::getAuthorsFileName.
  • SpecialVersion::getExtLicenseFileName, deprecated in 1.35, has been removed. Use MediaWiki\ExtensionInfo::getLicenseFileNames.
  • CategoryPage::getCategoryViewerClass and ::setCategoryViewerClass, deprecated in 1.35, have been removed.
  • SqlBlobStore::getLegacyEncodingConversionLang(), deprecated in 1.34, has been removed.
  • wfCanIPUseHTTPS(), deprecated in 1.37, has been removed.
  • wfGetScriptUrl(), deprecated in 1.35, has been removed.
  • The following methods of Database class, are no longer stable to override:
    • ::implicitOrderby()
    • ::selectSQLText()
    • ::bitNot()
    • ::bitAnd()
    • ::bitOr()
    • ::buildConcat()
    • ::buildGreatest()
    • ::buildLeast()
    • ::buildSubstring()
    • ::buildStringCast()
    • ::buildIntegerCast()
    • ::tableName()
    • ::addIdentifierQuotes()
    • ::buildLike()
    • ::limitResult()
    • ::unionSupportsOrderAndLimit()
    • ::unionQueries()
    • ::conditional()
    • ::strreplace()
    • ::timestamp()
    • ::getInfinity()
    • ::setTableAliases()
    • ::setIndexAliases()
    • ::buildGroupConcatField()
  • SpecialUnblock::processUnblock(), deprecated in 1.36, has been removed. Use UnblockUser instead.
  • wfLocalFile() and wfFindFile(), deprecated in 1.34, have been removed.
  • Maintenance script resetUserTokens.php, deprecated in 1.27, has been removed.
  • These methods in Database have been removed without deprecation as they are not used outside core. Users should override corresponding methods in SQLPlatform instead:
    • Database::doInsert -> SQLPlatform::insertSqlText
    • Database::doDropTable -> SQLPlatform::dropTableSqlText
    • Database::doRollback -> SQLPlatform::rollbackSqlText
    • Database::doSavepoint -> SQLPlatform::savepointSqlText
    • Database::doReleaseSavepoint -> SQLPlatform::releaseSavepointSqlText
    • Database::doRollbackToSavepoint -> SQLPlatform::rollbackToSavepointSqlText
  • The following protected methods of Database class have been removed without deprecation as they are not used outside core. Users should call corresponding methods in SQLPlatform:
    • Database::makeInsertLists -> SQLPlatform::makeInsertLists
    • Database::isFlagInOptions -> SQLPlatform::isFlagInOptions
    • Database::normalizeOptions -> SQLPlatform::normalizeOptions
    • Database::fieldNameWithAlias -> SQLPlatform::fieldNameWithAlias
    • Database::isTransactableQuery -> SQLPlatform::isTransactableQuery
  • $wgCanonicalNamespaceNames no longer includes custom namespaces defined using $wgExtraNamespaces . Extensions should use the NamespaceInfo service instead of accessing this configuration setting directly.
  • The following hook, deprecated in 1.35, has been removed:
    • ParserGetVariableValueVarCache: ParserGetVariableValueVarCacheHook
  • The $variableCache parameter to the ParserGetVariableValueSwitch hook is no longer used; non-standard use of this parameter has been deprecated since 1.35.
  • These methods have been moved from IDatabase to IMaintainableDatabase:
    • IDatabase::fieldExists -> IMaintainableDatabase::fieldExists
    • IDatabase::indexExists -> IMaintainableDatabase::indexExists
    • IDatabase::tableExists -> IMaintainableDatabase::tableExists
  • DBConnRef doesn't accept live connection in constructor anymore. Only parameters for getting connection should be provided.
  • IDatabase::getTopologyRootPrimary() was removed.
  • User::blockedBy(), deprecated since 1.38, has been removed.
  • User::getBlockId(), deprecated since 1.38, has been removed.

Deprecations in 1.39 edit

  • PageProps::getInstance(), deprecated since 1.38, emits deprecations warnings.
  • The global function wfGetDB() has been deprecated. Use LoadBalancer::getConnection() instead.
  • SpecialRedirectWithAction::__construct without SearchEngineFactory argument is hard deprecated.
  • Use of the SiteStatsUpdate constructor has been deprecated in favor of the ::factory() method.
  • AuthManager::checkAccountCreatePermissions has been deprecated. Use AuthManager::authorizeCreateAccount or AuthManager::probablyCanCreateAccount instead.
  • Title::getSelectFields() has been deprecated in favor of PageStore::newSelectQueryBuilder()
  • Title::newFromTitleValue(), deprecated since in 1.34, now emits deprecation warnings. Use ::newFromLinkTarget() instead.
  • ExtensionRegistry::readFromQueue() has been marked @internal. Extensions should use ExtensionProcessor instead.
  • Processor::getExtraAutoloaderPaths() and ExtensionProcessor::getExtraAutoloaderPaths() have been deprecated, use get getExtractedAutoloadInfo() instead.
  • The following global functions are deprecated in favor of the listed UrlUtils methods.
    • wfExpandUrl -> UrlUtils::expand
    • wfGetServerUrl -> UrlUtils::getServer
    • wfAssembleUrl -> UrlUtils::assemble
    • wfRemoveDotSegments -> UrlUtils::removeDotSegments
    • wfUrlProtocols -> UrlUtils::validProtocols
    • wfUrlProtocolsWithoutProtRel -> UrlUtils::validAbsoluteProtocols
    • wfParseUrl -> UrlUtils::parse
    • wfExpandIRI -> UrlUtils::expandIRI
    • wfMatchesDomainList -> UrlUtils::matchesDomainList

These methods are exact replacements except that

  1. they return null instead of false or empty string on error (where applicable);
  2. UrlUtils::validProtocols does not take a parameter (documentation said not to pass one to wfUrlProtocols anyway);
  3. they use type hints (don't try passing null instead of string, etc.).
  • MaintainableDBConnRef is deprecated, use DBConnRef instead.
  • Loading DefaultSettings.php is deprecated. To get default values of main config settings, use MainConfigSchema::listDefaultValues() or MainConfigSchema::getDefaultValue().
  • AbstractContent::getRedirectChain() and AbstractContent::getUltimateRedirectTarget() are now emitting deprecation warnings (task T296430).
  • (task T244138) QueryPage::getSQL() is deprecated. Instead QueryPage::getQueryInfo() should be overridden.
  • Calling new JobRunner() directly without $serviceOptions now emits deprecation warnings. Use MediaWikiServices::getInstance()->getJobRunner() instead.
  • Passing an array of targets to Article::getRedirectHeaderHtml() is deprecated. Supply a single redirect target instead (task T296430).
  • The following Less mediawiki.mixins have been deprecated:
    • .animation()
    • .animation-delay()
    • .transform-rotate()
  • Skin::getAction is deprecated. Use IContextSource::getActionName instead.
  • User::getOption, deprecated since 1.35, now emits deprecation warnings. Use UserOptionsLookup::getOption instead.
  • ILBFactory::forEachLB() is deprecated. Use ::getAllLBs().
  • LoadBalancer::forEachOpenConnection() and ::forEachOpenPrimaryConnection() are deprecated without replacement.
  • The following classes were moved from the root namespace to the MediaWiki\ResourceLoader namespace, the old names becoming deprecated aliases: ResourceLoader, MessageBlobStore, VueComponentParser.
  • The following classes had the "ResourceLoader" prefix stripped while being moved to the MediaWiki\ResourceLoader namespace, the old names becoming deprecated aliases: DerivativeResourceLoaderContext, ResourceLoaderCircularDependencyError, ResourceLoaderClientHtml, ResourceLoaderCodexModule, ResourceLoaderContext, ResourceLoaderFileModule, ResourceLoaderFilePath, ResourceLoaderForeignApiModule, ResourceLoaderImage, ResourceLoaderImageModule, ResourceLoaderLanguageDataModule, ResourceLoaderLessVarFileModule, ResourceLoaderModule, ResourceLoaderMwUrlModule, ResourceLoaderOOUIFileModule, ResourceLoaderOOUIIconPackModule, ResourceLoaderOOUIImageModule, ResourceLoaderOOUIModule, ResourceLoaderSiteModule, ResourceLoaderSiteStylesModule, ResourceLoaderSkinModule, ResourceLoaderStartUpModule, ResourceLoaderUserModule, ResourceLoaderUserOptionsModule, ResourceLoaderUserStylesModule, ResourceLoaderWikiModule.
  • The following methods in WikiRevision and their interfaces ImportableUploadRevision and ImportableOldRevision are deprecated:
    • ::getUserObj() → ::getUser()
    • ::setUserObj() → ::setUsername()
    • ::setUserIP() → ::setUsername()
  • ObjectCache::addBusyCallback() is deprecated and non-functional.
  • MWTimestamp::getHumanTimestamp(), deprecated in 1.26, now emits deprecation warnings.
  • Article::viewRedirect(), deprecated in 1.30, now emits deprecation warnings.
  • Parser::getFreshParser() is deprecated, use ParserFactory::getInstance().
  • CoreParserFunctions::mwnamespace() is deprecated and emits deprecation warnings, use CoreParserFunctions::namespace() instead.
  • Registering magic variables whose names include a colon is deprecated.
  • User::blockedFor(), deprecated in 1.35, now emits deprecation warnings.
  • Access to previously public properties AbstractBlock::$mExpiry, AbstractBlock::$mHideName, AbstractBlock::$mTimestamp, DatabaseBlock::$mAuto, and DatabaseBlock::$mParentBlockId, deprecated in 1.34, now emits deprecation warnings.
  • Access to previously public properties User::$mBlock, User::$mBlockedby, and User::$mHideName, deprecated in 1.35, now emits deprecation warnings.
  • JobQueueGroup::singleton() and ::destroySingletons(), deprecated in 1.37, now emit deprecation warnings.
  • Title::getNotificationTimestamp(), deprecated in 1.35, now emits deprecation warnings.
  • Global functions wfReadOnly and wfReadOnlyReason, deprecated in 1.38, now emit deprecation warnings.
  • Overriding or calling DifferenceEngine::getDiffBodyCacheKey(), deprecated in 1.31, now emits deprecation warnings.
  • Access to previously public property WikiRevision::$fileIsTemp, deprecated in 1.29, now emits deprecation warnings.
  • wfQueriesMustScale() has been deprecated and emits deprecation warnings.
  • ContextSource::getStats(), RequestContext::getStats(), and DerivativeContext::getStats(), deprecated in 1.27, now emit deprecation warnings.
  • ManualLogEntry::setTags(), deprecated in 1.33, now emits deprecation warnings.
  • WikiRevision::downloadSource(), deprecated in 1.31, now emits deprecation warnings.
  • DifferenceEngine::textDiff(), deprecated in 1.32, now emits deprecation warnings.
  • FormatMetadata::flattenArrayContentLang(), deprecated in 1.36, now emits deprecation warnings.
  • SkinTemplate::getNameSpaceKey(), deprecated in 1.35, now emits deprecation warnings.
  • EnqueueJob::newFromJobsByWiki(), deprecated in 1.33, now emits deprecation warnings.
  • The following methods of the MWGrants class, all deprecated since 1.38, are now emitting deprecation warnings:
    • getValidGrants
    • getRightsByGrant
    • grantName
    • grantNames
    • getGrantRights
    • grantsAreValid
    • getGrantGroups
    • getHiddenGrants
    • getGrantsLink
    • getGrantsWikiText
  • DataUpdate::runUpdates(), deprecated in 1.28, now emits deprecation warnings.
  • CdnCacheUpdate::newFromTitles(), deprecated in 1.35, now emits deprecation warnings.
  • Instantiating HTMLCacheUpdate class, deprecated in 1.34, now emits deprecation warnings.
  • ISQLPlatform::tableNames() (implemented by IDatabase) is soft deprecated. None of the tableName*() functions should be used by most users; if you absolutely must use raw SQL, write several tableName() calls instead.
  • Language::isWellFormedLanguageTag() has been deprecated in favor of LanguageCode::isWellFormedLanguageTag().
  • The PrevNextNavigationRenderer helper class has been deprecated in favor of the new PagerNavigationBuilder one.
  • The methods IndexPager::getPagingLinks(), IndexPager::getLimitLinks() and IndexPager::buildPrevNextNavigation() have been deprecated in favor of IndexPager::getNavigationBuilder().
  • Overriding the method IndexPager::makeLink() has been deprecated.

Other changes in 1.39 edit

  • Dynamic default values are now applied before extension registration callbacks are run. This way, extensions have a complete view of config variables, with all defaults applied. For example, when the default value of X used to be static but becomes dynamic, and an extension reads the value of X in the registration callback, it will now continue to function as expected. In some cases however, this may cause an undesired change in behavior: if the dynamic default of setting X depends on the value of setting Y, and an extension changes Y, the changed value of Y will no longer affect the value of X.

Compatibility edit

MediaWiki 1.39 requires PHP 7.4.3 or later and the following PHP extensions:

  • ctype
  • dom
  • fileinfo
  • iconv
  • intl
  • json
  • mbstring
  • xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can be used instead, but support for them is somewhat less mature.

The supported versions are:

  • MariaDB 10.3 or higher
  • MySQL 5.7.0 or higher
  • PostgreSQL 10 or later
  • SQLite 3.8.0 or later

Online documentation edit

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

[1]

Mailing list edit

A mailing list is available for MediaWiki user support and discussion:

[2]

A low-traffic announcements-only list is also available:

[3]

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help edit

There's usually someone online in #mediawiki on irc.libera.chat.

Retrieved from "https://www.mediawiki.org/w/index.php?title=User:Svemir_Brkic/Releases&oldid=5705443"